postfix-3.2-20170206

postfix/HISTORY

@@ -22885,9 +22885,44 @@ Apologies for any names omitted.
 
 20170129
 
-	Cleanup: environment settings for root and non-root users
+	Cleanup: bogus UTC timezone setting for postqueue/mailq
-	in set-gid programs. File: postqueue/postqueue.c (enforce
+	command output, and other environment settings for root and
-	import_environment name=value overrides for root users),
+	non-root users in set-gid programs. File: postqueue/postqueue.c
-	util/msg_syslog_init.c (don't override non-existent TZ
+	(enforce import_environment name=value overrides for root
-	settings), util/unsafe.c (exclude root from privilege
+	users), util/msg_syslog_init.c (don't override non-existent
-	escalation concerns).
+	TZ settings with UTC), util/unsafe.c (exclude uid==0, euid==0
+	super-user from privilege escalation concerns).
+
+20170131
+
+	Cleanup: more complete VALGRIND coverage for test build targets
+	and scripts. Files: postalias/fail_test.in, postmap/fail_test.in,
+	postmap/quote_test.in, util/dict_pipe_test.in,
+	util/dict_union_test.in, util/dict_utf8_test.in.
+
+
+20170201
+
+	Portability: unsetenv() for ancient platforms. File:
+	makedefs, util/sys_compat.c.
+
+20170205
+
+	Cleanup: security checks for config_directory overrides.
+	File: global/mail_conf.c.
+
+	Cleanup: enforce import_environment name=value settings in
+	command-line utilities, for consistency with Postfix daemons (but
+	without removing environment variables).  This is not enforced
+	in the postconf command which must be able to process main.cf
+	files with incomplete settings. Files: postalias/postalias.c,
+	postcat/postcat.c, postkick/postkick.c, postlock/postlock.c,
+	postlog/postlog.c, postmap/postmap.c, postsuper/postsuper.c,
+	posttls-finger/posttls-finger.c, sendmail/sendmail.c,
+	util/clean_env.[hc].
+
+20170206
+
+	Bugfix (introduced: Postfix 2.2): check_mumble_a_access
+	did not handle [ipaddress], unlike check_mumble_mx_access. 
+	Reported by James (postfix_tracker). File: smtpd/smtpd_check.c.

postfix/html/mailq.1.html

@@ -405,6 +405,11 @@ SENDMAIL(1)                                                        SENDMAIL(1)
               The time after which the sender receives a copy of  the  message
               headers of mail that is still queued.
 
+       <b><a href="postconf.5.html#import_environment">import_environment</a> (see 'postconf -d' output)</b>
+              The  list  of  environment  parameters that a privileged Postfix
+              process will  import  from  a  non-Postfix  parent  process,  or
+              name=value environment overrides.
+
        <b><a href="postconf.5.html#mail_owner">mail_owner</a> (postfix)</b>
               The  UNIX  system  account  that owns the Postfix queue and most
               Postfix daemon processes.
@@ -429,7 +434,7 @@ SENDMAIL(1)                                                        SENDMAIL(1)
        <b><a href="postconf.5.html#alternate_config_directories">alternate_config_directories</a> (empty)</b>
               A list of non-default Postfix configuration directories that may
               be specified with "-c <a href="postconf.5.html#config_directory">config_directory</a>" on the command line  (in
-              the  case of <a href="sendmail.1.html"><b>sendmail</b>(1)</a>, with -C <a href="postconf.5.html#config_directory">config_directory</a>"), or via the
+              the case of <a href="sendmail.1.html"><b>sendmail</b>(1)</a>, with "-C <a href="postconf.5.html#config_directory">config_directory</a>"), or via the
               MAIL_CONFIG environment parameter.
 
        <b><a href="postconf.5.html#multi_instance_directories">multi_instance_directories</a> (empty)</b>

postfix/html/newaliases.1.html

@@ -405,6 +405,11 @@ SENDMAIL(1)                                                        SENDMAIL(1)
               The time after which the sender receives a copy of  the  message
               headers of mail that is still queued.
 
+       <b><a href="postconf.5.html#import_environment">import_environment</a> (see 'postconf -d' output)</b>
+              The  list  of  environment  parameters that a privileged Postfix
+              process will  import  from  a  non-Postfix  parent  process,  or
+              name=value environment overrides.
+
        <b><a href="postconf.5.html#mail_owner">mail_owner</a> (postfix)</b>
               The  UNIX  system  account  that owns the Postfix queue and most
               Postfix daemon processes.
@@ -429,7 +434,7 @@ SENDMAIL(1)                                                        SENDMAIL(1)
        <b><a href="postconf.5.html#alternate_config_directories">alternate_config_directories</a> (empty)</b>
               A list of non-default Postfix configuration directories that may
               be specified with "-c <a href="postconf.5.html#config_directory">config_directory</a>" on the command line  (in
-              the  case of <a href="sendmail.1.html"><b>sendmail</b>(1)</a>, with -C <a href="postconf.5.html#config_directory">config_directory</a>"), or via the
+              the case of <a href="sendmail.1.html"><b>sendmail</b>(1)</a>, with "-C <a href="postconf.5.html#config_directory">config_directory</a>"), or via the
               MAIL_CONFIG environment parameter.
 
        <b><a href="postconf.5.html#multi_instance_directories">multi_instance_directories</a> (empty)</b>

postfix/html/postalias.1.html

@@ -187,6 +187,11 @@ POSTALIAS(1)                                                      POSTALIAS(1)
               The default database type for use in <a href="newaliases.1.html"><b>newaliases</b>(1)</a>, <a href="postalias.1.html"><b>postalias</b>(1)</a>
               and <a href="postmap.1.html"><b>postmap</b>(1)</a> commands.
 
+       <b><a href="postconf.5.html#import_environment">import_environment</a> (see 'postconf -d' output)</b>
+              The  list  of  environment  parameters that a privileged Postfix
+              process will  import  from  a  non-Postfix  parent  process,  or
+              name=value environment overrides.
+
        <b><a href="postconf.5.html#smtputf8_enable">smtputf8_enable</a> (yes)</b>
               Enable  preliminary SMTPUTF8 support for the protocols described
               in <a href="http://tools.ietf.org/html/rfc6531">RFC 6531</a>..6533.

postfix/html/postcat.1.html

@@ -74,6 +74,11 @@ POSTCAT(1)                                                          POSTCAT(1)
               The  default  location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con-
               figuration files.
 
+       <b><a href="postconf.5.html#import_environment">import_environment</a> (see 'postconf -d' output)</b>
+              The list of environment parameters  that  a  privileged  Postfix
+              process  will  import  from  a  non-Postfix  parent  process, or
+              name=value environment overrides.
+
        <b><a href="postconf.5.html#queue_directory">queue_directory</a> (see 'postconf -d' output)</b>
               The location of the Postfix top-level queue directory.
 

postfix/html/postconf.1.html

@@ -226,11 +226,12 @@ POSTCONF(1)                                                        POSTCONF(1)
 
               <b>environ</b>
                      The UNIX process environment array. The lookup key is the
-                     variable  name. Originally implemented for testing, some-
+                     environment  variable  name;  the  table name is ignored.
-                     one may find this useful someday.
+                     Originally implemented for testing, someone may find this
+                     useful someday.
 
-              <b>fail</b>   A table that reliably fails all requests. The lookup  ta-
+              <b>fail</b>   A  table that reliably fails all requests. The lookup ta-
-                     ble  name  is used for logging. This table exists to sim-
+                     ble name is used for logging. This table exists  to  sim-
                      plify Postfix error tests.
 
                      This feature is available with Postfix 2.9 and later.
@@ -239,22 +240,22 @@ POSTCONF(1)                                                        POSTCONF(1)
                      tems with support for Berkeley DB databases.
 
               <b>inline</b> (read-only)
-                     A  non-shared, in-memory lookup table. Example: "<b><a href="DATABASE_README.html#types">inline</a>:{</b>
+                     A non-shared, in-memory lookup table. Example:  "<b><a href="DATABASE_README.html#types">inline</a>:{</b>
-                     <i>key</i><b>=</b><i>value</i><b>, {</b> <i>key</i> <b>=</b> <i>text with  whitespace  or  comma</i>  <b>}}</b>".
+                     <i>key</i><b>=</b><i>value</i><b>,  {</b>  <i>key</i>  <b>=</b>  <i>text with whitespace or comma</i> <b>}}</b>".
-                     Key-value  pairs  are  separated  by whitespace or comma;
+                     Key-value pairs are separated  by  whitespace  or  comma;
-                     whitespace after "<b>{</b>" and before "<b>}</b>"  is  ignored.  Inline
+                     whitespace  after  "<b>{</b>"  and before "<b>}</b>" is ignored. Inline
-                     tables  eliminate  the need to create a database file for
+                     tables eliminate the need to create a database  file  for
-                     just a few fixed elements.   See  also  the  <i><a href="DATABASE_README.html#types">static</a>:</i>  map
+                     just  a  few  fixed  elements.   See also the <i><a href="DATABASE_README.html#types">static</a>:</i> map
                      type.
 
                      This feature is available with Postfix 3.0 and later.
 
               <b>internal</b>
-                     A  non-shared, in-memory hash table. Its content are lost
+                     A non-shared, in-memory hash table. Its content are  lost
                      when a process terminates.
 
-              <b>lmdb</b>   OpenLDAP  LMDB  database  (a  memory-mapped,   persistent
+              <b>lmdb</b>   OpenLDAP   LMDB  database  (a  memory-mapped,  persistent
-                     file).   Available on systems with support for LMDB data-
+                     file).  Available on systems with support for LMDB  data-
                      bases.  This is described in <a href="lmdb_table.5.html"><b>lmdb_table</b>(5)</a>.
 
                      This feature is available with Postfix 2.11 and later.
@@ -263,57 +264,57 @@ POSTCONF(1)                                                        POSTCONF(1)
                      LDAP database client. This is described in <a href="ldap_table.5.html"><b>ldap_table</b>(5)</a>.
 
               <b>memcache</b>
-                     Memcache  database  client.  This  is  described  in <a href="memcache_table.5.html"><b>mem-</b></a>
+                     Memcache database  client.  This  is  described  in  <a href="memcache_table.5.html"><b>mem-</b></a>
                      <a href="memcache_table.5.html"><b>cache_table</b>(5)</a>.
 
                      This feature is available with Postfix 2.9 and later.
 
               <b>mysql</b> (read-only)
                      MySQL database client.  Available on systems with support
-                     for  MySQL  databases.   This  is  described in <a href="mysql_table.5.html"><b>mysql_ta-</b></a>
+                     for MySQL databases.   This  is  described  in  <a href="mysql_table.5.html"><b>mysql_ta-</b></a>
                      <a href="mysql_table.5.html"><b>ble</b>(5)</a>.
 
               <b>pcre</b> (read-only)
-                     A lookup table based on Perl Compatible  Regular  Expres-
+                     A  lookup  table based on Perl Compatible Regular Expres-
                      sions.  The file format is described in <a href="pcre_table.5.html"><b>pcre_table</b>(5)</a>.
 
               <b>pgsql</b> (read-only)
-                     PostgreSQL   database   client.   This  is  described  in
+                     PostgreSQL  database  client.  This   is   described   in
                      <a href="pgsql_table.5.html"><b>pgsql_table</b>(5)</a>.
 
                      This feature is available with Postfix 2.1 and later.
 
               <b>pipemap</b> (read-only)
-                     A lookup table that  constructs  a  pipeline  of  tables.
+                     A  lookup  table  that  constructs  a pipeline of tables.
-                     Example:  "<b><a href="DATABASE_README.html#types">pipemap</a>:{</b><i>type</i><b>_</b><i>1:name</i><b>_</b><i>1,  ..., type</i><b>_</b><i>n:name</i><b>_</b><i>n</i><b>}</b>".
+                     Example: "<b><a href="DATABASE_README.html#types">pipemap</a>:{</b><i>type</i><b>_</b><i>1:name</i><b>_</b><i>1,  ...,  type</i><b>_</b><i>n:name</i><b>_</b><i>n</i><b>}</b>".
-                     Each "<a href="DATABASE_README.html#types">pipemap</a>:" query is given to the first table.   Each
+                     Each  "<a href="DATABASE_README.html#types">pipemap</a>:" query is given to the first table.  Each
                      lookup result becomes the query for the next table in the
-                     pipeline, and the last table produces the  final  result.
+                     pipeline,  and  the last table produces the final result.
-                     When  any  table  lookup produces no result, the pipeline
+                     When any table lookup produces no  result,  the  pipeline
-                     produces no result. The first and last characters of  the
+                     produces  no result. The first and last characters of the
                      "<a href="DATABASE_README.html#types">pipemap</a>:" table name must be "<b>{</b>" and "<b>}</b>".  Within these,
                      individual maps are separated with comma or whitespace.
 
                      This feature is available with Postfix 3.0 and later.
 
-              <b>proxy</b>  Postfix <a href="proxymap.8.html"><b>proxymap</b>(8)</a> client for shared access  to  Postfix
+              <b>proxy</b>  Postfix  <a href="proxymap.8.html"><b>proxymap</b>(8)</a>  client for shared access to Postfix
                      databases. The table name syntax is <i>type</i><b>:</b><i>name</i>.
 
                      This feature is available with Postfix 2.0 and later.
 
               <b>randmap</b> (read-only)
-                     An  in-memory table that performs random selection. Exam-
+                     An in-memory table that performs random selection.  Exam-
                      ple:  "<b><a href="DATABASE_README.html#types">randmap</a>:{</b><i>result</i><b>_</b><i>1,  ...,  result</i><b>_</b><i>n</i><b>}</b>".  Each  table
                      query returns a random choice from the specified results.
-                     The first and last characters  of  the  "<a href="DATABASE_README.html#types">randmap</a>:"  table
+                     The  first  and  last  characters of the "<a href="DATABASE_README.html#types">randmap</a>:" table
-                     name  must  be  "<b>{</b>"  and  "<b>}</b>".   Within these, individual
+                     name must be  "<b>{</b>"  and  "<b>}</b>".   Within  these,  individual
                      results are separated with comma or whitespace. To give a
                      specific result more weight, specify it multiple times.
 
                      This feature is available with Postfix 3.0 and later.
 
               <b>regexp</b> (read-only)
-                     A  lookup  table  based  on regular expressions. The file
+                     A lookup table based on  regular  expressions.  The  file
                      format is described in <a href="regexp_table.5.html"><b>regexp_table</b>(5)</a>.
 
               <b>sdbm</b>   An indexed file type based on hashing.  Available on sys-
@@ -322,9 +323,9 @@ POSTCONF(1)                                                        POSTCONF(1)
                      This feature is available with Postfix 2.2 and later.
 
               <b>socketmap</b> (read-only)
-                     Sendmail-style   socketmap  client.  The  table  name  is
+                     Sendmail-style  socketmap  client.  The  table  name   is
-                     <b>inet</b>:<i>host</i>:<i>port</i>:<i>name</i> for a TCP/IP  server,  or  <b>unix</b>:<i>path-</i>
+                     <b>inet</b>:<i>host</i>:<i>port</i>:<i>name</i>  for  a  TCP/IP server, or <b>unix</b>:<i>path-</i>
-                     <i>name</i>:<i>name</i>  for a UNIX-domain server. This is described in
+                     <i>name</i>:<i>name</i> for a UNIX-domain server. This is described  in
                      <a href="socketmap_table.5.html"><b>socketmap_table</b>(5)</a>.
 
                      This feature is available with Postfix 2.10 and later.
@@ -335,10 +336,10 @@ POSTCONF(1)                                                        POSTCONF(1)
                      This feature is available with Postfix 2.8 and later.
 
               <b>static</b> (read-only)
-                     A table that always returns its name  as  lookup  result.
+                     A  table  that  always returns its name as lookup result.
                      For example, <b><a href="DATABASE_README.html#types">static</a>:foobar</b> always returns the string <b>foo-</b>
-                     <b>bar</b> as lookup result. Specify "<b><a href="DATABASE_README.html#types">static</a>:{</b> <i>text with  white-</i>
+                     <b>bar</b>  as lookup result. Specify "<b><a href="DATABASE_README.html#types">static</a>:{</b> <i>text with white-</i>
-                     <i>space</i>  <b>}</b>"  when the result contains whitespace; this form
+                     <i>space</i> <b>}</b>" when the result contains whitespace;  this  form
                      ignores whitespace after "<b>{</b>" and before "<b>}</b>". See also the
                      <i><a href="DATABASE_README.html#types">inline</a>:</i> map.
 
@@ -349,57 +350,57 @@ POSTCONF(1)                                                        POSTCONF(1)
                      TCP/IP client. The protocol is described in <a href="tcp_table.5.html"><b>tcp_table</b>(5)</a>.
 
               <b>texthash</b> (read-only)
-                     Produces  similar results as <a href="DATABASE_README.html#types">hash</a>: files, except that you
+                     Produces similar results as <a href="DATABASE_README.html#types">hash</a>: files, except that  you
-                     don't need to run the <a href="postmap.1.html"><b>postmap</b>(1)</a> command before  you  can
+                     don't  need  to run the <a href="postmap.1.html"><b>postmap</b>(1)</a> command before you can
-                     use  the  file, and that it does not detect changes after
+                     use the file, and that it does not detect  changes  after
                      the file is read.
 
                      This feature is available with Postfix 2.8 and later.
 
               <b>unionmap</b> (read-only)
-                     A table that sends each query to multiple  lookup  tables
+                     A  table  that sends each query to multiple lookup tables
-                     and  that  concatenates  all  found results, separated by
+                     and that concatenates all  found  results,  separated  by
                      comma.  The table name syntax is the same as for <b>pipemap</b>.
 
                      This feature is available with Postfix 3.0 and later.
 
               <b>unix</b> (read-only)
-                     A  limited  view of the UNIX authentication database. The
+                     A limited view of the UNIX authentication  database.  The
                      following tables are implemented:
 
                      <b>unix:passwd.byname</b>
-                            The table is the UNIX password database.  The  key
+                            The  table  is the UNIX password database. The key
-                            is  a  login  name.  The result is a password file
+                            is a login name.  The result is  a  password  file
                             entry in <b>passwd</b>(5) format.
 
                      <b>unix:group.byname</b>
                             The table is the UNIX group database. The key is a
-                            group  name.   The result is a group file entry in
+                            group name.  The result is a group file  entry  in
                             <b>group</b>(5) format.
 
-              Other table types may exist depending on how Postfix was  built.
+              Other  table types may exist depending on how Postfix was built.
 
-       <b>-M</b>     Show  <a href="master.5.html"><b>master.cf</b></a>  file contents instead of <a href="postconf.5.html"><b>main.cf</b></a> file contents.
+       <b>-M</b>     Show <a href="master.5.html"><b>master.cf</b></a> file contents instead of <a href="postconf.5.html"><b>main.cf</b></a>  file  contents.
               Specify <b>-Mf</b> to fold long lines for human readability.
 
               Specify zero or more arguments, each with a <i>service-name</i> or <i>ser-</i>
-              <i>vice-name/service-type</i>  pair,  where  <i>service-name</i>  is the first
+              <i>vice-name/service-type</i> pair, where  <i>service-name</i>  is  the  first
-              field of a <a href="master.5.html">master.cf</a> entry and <i>service-type</i>  is  one  of  (<b>inet</b>,
+              field  of  a  <a href="master.5.html">master.cf</a>  entry and <i>service-type</i> is one of (<b>inet</b>,
               <b>unix</b>, <b>fifo</b>, or <b>pass</b>).
 
-              If  <i>service-name</i> or <i>service-name/service-type</i> is specified, only
+              If <i>service-name</i> or <i>service-name/service-type</i> is specified,  only
-              the matching <a href="master.5.html">master.cf</a> entries  will  be  output.  For  example,
+              the  matching  <a href="master.5.html">master.cf</a>  entries  will  be output. For example,
-              "<b>postconf  -Mf  smtp</b>" will output all services named "smtp", and
+              "<b>postconf -Mf smtp</b>" will output all services named  "smtp",  and
-              "<b>postconf -Mf smtp/inet</b>" will output only the smtp service  that
+              "<b>postconf  -Mf smtp/inet</b>" will output only the smtp service that
-              listens  on  the network.  Trailing service type fields that are
+              listens on the network.  Trailing service type fields  that  are
               omitted will be handled as "*" wildcard fields.
 
               This feature is available with Postfix 2.9 and later. The syntax
-              was  changed  from  "<i>name.type</i>" to "<i>name/type</i>", and "*" wildcard
+              was changed from "<i>name.type</i>" to "<i>name/type</i>",  and  "*"  wildcard
               support was added with Postfix 2.11.
 
        <b>-n</b>     Show only configuration parameters that have explicit <i>name=value</i>
-              settings  in  <a href="postconf.5.html"><b>main.cf</b></a>.  Specify <b>-nf</b> to fold long lines for human
+              settings in <a href="postconf.5.html"><b>main.cf</b></a>.  Specify <b>-nf</b> to fold long lines  for  human
               readability (Postfix 2.9 and later).
 
        <b>-o</b> <i>name=value</i>
@@ -411,38 +412,38 @@ POSTCONF(1)                                                        POSTCONF(1)
 
               This feature is available with Postfix 2.11 and later.
 
-       <b>-P</b>     Show <a href="master.5.html"><b>master.cf</b></a> service parameter settings (by default  all  ser-
+       <b>-P</b>     Show  <a href="master.5.html"><b>master.cf</b></a>  service parameter settings (by default all ser-
-              vices  and  all  parameters), formatted as "<i>service/type/parame-</i>
+              vices and all parameters),  formatted  as  "<i>service/type/parame-</i>
               <i>ter=value</i>", one per line.  Specify <b>-Pf</b> to fold long lines.
 
-              Specify one or more "<i>service/type/parameter</i>"  instances  on  the
+              Specify  one  or  more "<i>service/type/parameter</i>" instances on the
-              <a href="postconf.1.html"><b>postconf</b>(1)</a>  command  line  to limit the output to parameters of
+              <a href="postconf.1.html"><b>postconf</b>(1)</a> command line to limit the output  to  parameters  of
-              interest.  Trailing parameter name or service type  fields  that
+              interest.   Trailing  parameter name or service type fields that
               are omitted will be handled as "*" wildcard fields.
 
               This feature is available with Postfix 2.11 and later.
 
        <b>-t</b> [<i>template</i><b>_</b><i>file</i>]
-              Display  the templates for text that appears at the beginning of
+              Display the templates for text that appears at the beginning  of
-              delivery status notification (DSN) messages,  without  expanding
+              delivery  status  notification (DSN) messages, without expanding
               $<b>name</b> expressions.
 
-              To  override the <b><a href="postconf.5.html#bounce_template_file">bounce_template_file</a></b> parameter setting, specify
+              To override the <b><a href="postconf.5.html#bounce_template_file">bounce_template_file</a></b> parameter setting,  specify
-              a template file name at the end of  the  "<b>postconf  -t</b>"  command
+              a  template  file  name  at the end of the "<b>postconf -t</b>" command
-              line.  Specify  an empty file name to display built-in templates
+              line. Specify an empty file name to display  built-in  templates
               (in shell language: "").
 
               This feature is available with Postfix 2.3 and later.
 
        <b>-T</b> <i>mode</i>
-              If Postfix is compiled without TLS support, the <b>-T</b>  option  pro-
+              If  Postfix  is compiled without TLS support, the <b>-T</b> option pro-
-              duces  no  output.   Otherwise, if an invalid <i>mode</i> is specified,
+              duces no output.  Otherwise, if an invalid  <i>mode</i>  is  specified,
-              the <b>-T</b> option reports an error and exits with a non-zero  status
+              the  <b>-T</b> option reports an error and exits with a non-zero status
               code. The valid modes are:
 
               <b>compile-version</b>
                      Output the OpenSSL version that Postfix was compiled with
-                     (i.e. the OpenSSL version in a header file).  The  output
+                     (i.e.  the  OpenSSL version in a header file). The output
                      format is the same as with the command "<b>openssl version</b>".
 
               <b>run-version</b>
@@ -450,59 +451,59 @@ POSTCONF(1)                                                        POSTCONF(1)
                      runtime (i.e. the OpenSSL version in a shared library).
 
               <b>public-key-algorithms</b>
-                     Output  the  lower-case names of the supported public-key
+                     Output the lower-case names of the  supported  public-key
                      algorithms, one per-line.
 
               This feature is available with Postfix 3.1 and later.
 
-       <b>-v</b>     Enable verbose  logging  for  debugging  purposes.  Multiple  <b>-v</b>
+       <b>-v</b>     Enable  verbose  logging  for  debugging  purposes.  Multiple <b>-v</b>
               options make the software increasingly verbose.
 
-       <b>-x</b>     Expand  <i>$name</i>  in  <a href="postconf.5.html"><b>main.cf</b></a>  or  <a href="master.5.html"><b>master.cf</b></a>  parameter values. The
+       <b>-x</b>     Expand <i>$name</i> in  <a href="postconf.5.html"><b>main.cf</b></a>  or  <a href="master.5.html"><b>master.cf</b></a>  parameter  values.  The
               expansion is recursive.
 
               This feature is available with Postfix 2.10 and later.
 
-       <b>-X</b>     Edit the <a href="postconf.5.html"><b>main.cf</b></a> configuration file, and remove  the  parameters
+       <b>-X</b>     Edit  the  <a href="postconf.5.html"><b>main.cf</b></a> configuration file, and remove the parameters
               named on the <a href="postconf.1.html"><b>postconf</b>(1)</a> command line.  Specify a list of param-
               eter names, not "<i>name=value</i>" pairs.
 
-              With <b>-M</b>, edit the <a href="master.5.html"><b>master.cf</b></a> configuration file, and  remove  one
+              With  <b>-M</b>,  edit the <a href="master.5.html"><b>master.cf</b></a> configuration file, and remove one
-              or  more service entries as specified with "<i>service/type</i>" on the
+              or more service entries as specified with "<i>service/type</i>" on  the
               <a href="postconf.1.html"><b>postconf</b>(1)</a> command line.
 
-              With <b>-P</b>, edit the <a href="master.5.html"><b>master.cf</b></a> configuration file, and  remove  one
+              With  <b>-P</b>,  edit the <a href="master.5.html"><b>master.cf</b></a> configuration file, and remove one
               or more service parameter settings (-o parameter=value settings)
-              as specified with "<i>service/type/parameter</i>"  on  the  <a href="postconf.1.html"><b>postconf</b>(1)</a>
+              as  specified  with  "<i>service/type/parameter</i>" on the <a href="postconf.1.html"><b>postconf</b>(1)</a>
               command line.
 
               In all cases the file is copied to a temporary file then renamed
               into place.  Specify quotes to protect special characters on the
               <a href="postconf.1.html"><b>postconf</b>(1)</a> command line.
 
-              There  is  no  <a href="postconf.1.html"><b>postconf</b>(1)</a> command to perform the reverse opera-
-              tion.
-
-              This feature is available with Postfix 2.10 and later.   Support
-              for -M and -P was added with Postfix 2.11.
-
-       <b>-#</b>     Edit the <a href="postconf.5.html"><b>main.cf</b></a> configuration file, and comment out the parame-
-              ters named on the <a href="postconf.1.html"><b>postconf</b>(1)</a> command line, so that those param-
-              eters revert to their default values.  Specify a list of parame-
-              ter names, not "<i>name=value</i>" pairs.
-
-              With <b>-M</b>, edit the <a href="master.5.html"><b>master.cf</b></a> configuration file, and comment  out
-              one  or more service entries as specified with "<i>service/type</i>" on
-              the <a href="postconf.1.html"><b>postconf</b>(1)</a> command line.
-
-              In all cases the file is copied to a temporary file then renamed
-              into place.  Specify quotes to protect special characters on the
-              <a href="postconf.1.html"><b>postconf</b>(1)</a> command line.
-
               There is no <a href="postconf.1.html"><b>postconf</b>(1)</a> command to perform  the  reverse  opera-
               tion.
 
-              This  feature  is  available with Postfix 2.6 and later. Support
+              This  feature is available with Postfix 2.10 and later.  Support
+              for -M and -P was added with Postfix 2.11.
+
+       <b>-#</b>     Edit the <a href="postconf.5.html"><b>main.cf</b></a> configuration file, and comment out the parame-
+              ters named on the <a href="postconf.1.html"><b>postconf</b>(1)</a> command line, so that those param-
+              eters revert to their default values.  Specify a list of parame-
+              ter names, not "<i>name=value</i>" pairs.
+
+              With  <b>-M</b>, edit the <a href="master.5.html"><b>master.cf</b></a> configuration file, and comment out
+              one or more service entries as specified with "<i>service/type</i>"  on
+              the <a href="postconf.1.html"><b>postconf</b>(1)</a> command line.
+
+              In all cases the file is copied to a temporary file then renamed
+              into place.  Specify quotes to protect special characters on the
+              <a href="postconf.1.html"><b>postconf</b>(1)</a> command line.
+
+              There  is  no  <a href="postconf.1.html"><b>postconf</b>(1)</a> command to perform the reverse opera-
+              tion.
+
+              This feature is available with Postfix 2.6  and  later.  Support
               for -M was added with Postfix 2.11.
 
 <b>DIAGNOSTICS</b>
@@ -513,18 +514,18 @@ POSTCONF(1)                                                        POSTCONF(1)
               Directory with Postfix configuration files.
 
 <b>CONFIGURATION PARAMETERS</b>
-       The following <a href="postconf.5.html"><b>main.cf</b></a> parameters are especially relevant to  this  pro-
+       The  following  <a href="postconf.5.html"><b>main.cf</b></a> parameters are especially relevant to this pro-
        gram.
 
-       The  text  below provides only a parameter summary. See <a href="postconf.5.html"><b>postconf</b>(5)</a> for
+       The text below provides only a parameter summary. See  <a href="postconf.5.html"><b>postconf</b>(5)</a>  for
        more details including examples.
 
        <b><a href="postconf.5.html#config_directory">config_directory</a> (see 'postconf -d' output)</b>
-              The default location of the Postfix <a href="postconf.5.html">main.cf</a> and  <a href="master.5.html">master.cf</a>  con-
+              The  default  location of the Postfix <a href="postconf.5.html">main.cf</a> and <a href="master.5.html">master.cf</a> con-
               figuration files.
 
        <b><a href="postconf.5.html#bounce_template_file">bounce_template_file</a> (empty)</b>
-              Pathname  of a configuration file with bounce message templates.
+              Pathname of a configuration file with bounce message  templates.
 
 <b>FILES</b>
        /etc/postfix/<a href="postconf.5.html">main.cf</a>, Postfix configuration parameters

postfix/html/postconf.5.html

@@ -3783,17 +3783,18 @@ mis-delivery of mail.
 <DT><b><a name="import_environment">import_environment</a>
 (default: see "postconf -d" output)</b></DT><DD>
 
-<p>
+<p> The list of environment parameters that a privileged Postfix
-The list of environment parameters that a Postfix process will
+process will import from a non-Postfix parent process, or name=value
-import from a non-Postfix parent process. Examples of relevant
+environment overrides.  Unprivileged utilities will enforce the
-parameters:
+name=value overrides, but otherwise will not change their process
-</p>
+environment.  Examples of relevant parameters: </p>
 
 <dl>
 
 <dt><b>TZ</b></dt>
 
-<dd>Needed for sane time keeping on most System-V-ish systems. </dd>
+<dd>May be needed for sane time keeping on most System-V-ish systems.
+</dd>
 
 <dt><b>DISPLAY</b></dt>
 

postfix/html/postkick.1.html

@@ -61,6 +61,11 @@ POSTKICK(1)                                                        POSTKICK(1)
               How long the <a href="postkick.1.html"><b>postkick</b>(1)</a> command waits for a  request  to  enter
               the Postfix daemon process input buffer before giving up.
 
+       <b><a href="postconf.5.html#import_environment">import_environment</a> (see 'postconf -d' output)</b>
+              The  list  of  environment  parameters that a privileged Postfix
+              process will  import  from  a  non-Postfix  parent  process,  or
+              name=value environment overrides.
+
        <b><a href="postconf.5.html#queue_directory">queue_directory</a> (see 'postconf -d' output)</b>
               The location of the Postfix top-level queue directory.
 

postfix/html/postlock.1.html

@@ -4,7 +4,7 @@
 <meta http-equiv="Content-Type" content="text/html; charset=us-ascii">
 <title> Postfix manual - postlock(1) </title>
 </head> <body> <pre>
-POSTLOCK(1)                 General Commands Manual                POSTLOCK(1)
+POSTLOCK(1)                                                        POSTLOCK(1)
 
 <b>NAME</b>
        postlock - lock mail folder and execute command
@@ -91,6 +91,11 @@ POSTLOCK(1)                 General Commands Manual                POSTLOCK(1)
               The default location of the Postfix <a href="postconf.5.html">main.cf</a> and  <a href="master.5.html">master.cf</a>  con-
               figuration files.
 
+       <b><a href="postconf.5.html#import_environment">import_environment</a> (see 'postconf -d' output)</b>
+              The  list  of  environment  parameters that a privileged Postfix
+              process will  import  from  a  non-Postfix  parent  process,  or
+              name=value environment overrides.
+
 <b>SEE ALSO</b>
        <a href="postconf.5.html">postconf(5)</a>, configuration parameters
 

postfix/html/postlog.1.html

@@ -59,6 +59,11 @@ POSTLOG(1)                                                          POSTLOG(1)
               The default location of the Postfix <a href="postconf.5.html">main.cf</a> and  <a href="master.5.html">master.cf</a>  con-
               figuration files.
 
+       <b><a href="postconf.5.html#import_environment">import_environment</a> (see 'postconf -d' output)</b>
+              The  list  of  environment  parameters that a privileged Postfix
+              process will  import  from  a  non-Postfix  parent  process,  or
+              name=value environment overrides.
+
        <b><a href="postconf.5.html#syslog_facility">syslog_facility</a> (mail)</b>
               The syslog facility of Postfix logging.
 

postfix/html/postmap.1.html

@@ -248,6 +248,11 @@ POSTMAP(1)                                                          POSTMAP(1)
               The default database type for use in <a href="newaliases.1.html"><b>newaliases</b>(1)</a>, <a href="postalias.1.html"><b>postalias</b>(1)</a>
               and <a href="postmap.1.html"><b>postmap</b>(1)</a> commands.
 
+       <b><a href="postconf.5.html#import_environment">import_environment</a> (see 'postconf -d' output)</b>
+              The  list  of  environment  parameters that a privileged Postfix
+              process will  import  from  a  non-Postfix  parent  process,  or
+              name=value environment overrides.
+
        <b><a href="postconf.5.html#smtputf8_enable">smtputf8_enable</a> (yes)</b>
               Enable  preliminary SMTPUTF8 support for the protocols described
               in <a href="http://tools.ietf.org/html/rfc6531">RFC 6531</a>..6533.

postfix/html/postsuper.1.html

@@ -222,6 +222,11 @@ POSTSUPER(1)                                                      POSTSUPER(1)
               The names of queue directories that are  split  across  multiple
               subdirectory levels.
 
+       <b><a href="postconf.5.html#import_environment">import_environment</a> (see 'postconf -d' output)</b>
+              The  list  of  environment  parameters that a privileged Postfix
+              process will  import  from  a  non-Postfix  parent  process,  or
+              name=value environment overrides.
+
        <b><a href="postconf.5.html#queue_directory">queue_directory</a> (see 'postconf -d' output)</b>
               The location of the Postfix top-level queue directory.
 

postfix/html/sendmail.1.html

@@ -405,6 +405,11 @@ SENDMAIL(1)                                                        SENDMAIL(1)
               The time after which the sender receives a copy of  the  message
               headers of mail that is still queued.
 
+       <b><a href="postconf.5.html#import_environment">import_environment</a> (see 'postconf -d' output)</b>
+              The  list  of  environment  parameters that a privileged Postfix
+              process will  import  from  a  non-Postfix  parent  process,  or
+              name=value environment overrides.
+
        <b><a href="postconf.5.html#mail_owner">mail_owner</a> (postfix)</b>
               The  UNIX  system  account  that owns the Postfix queue and most
               Postfix daemon processes.
@@ -429,7 +434,7 @@ SENDMAIL(1)                                                        SENDMAIL(1)
        <b><a href="postconf.5.html#alternate_config_directories">alternate_config_directories</a> (empty)</b>
               A list of non-default Postfix configuration directories that may
               be specified with "-c <a href="postconf.5.html#config_directory">config_directory</a>" on the command line  (in
-              the  case of <a href="sendmail.1.html"><b>sendmail</b>(1)</a>, with -C <a href="postconf.5.html#config_directory">config_directory</a>"), or via the
+              the case of <a href="sendmail.1.html"><b>sendmail</b>(1)</a>, with "-C <a href="postconf.5.html#config_directory">config_directory</a>"), or via the
               MAIL_CONFIG environment parameter.
 
        <b><a href="postconf.5.html#multi_instance_directories">multi_instance_directories</a> (empty)</b>

postfix/makedefs

@@ -383,7 +383,11 @@ case "$SYSTEM.$RELEASE" in
 		case $RELEASE in
 		    5.[0-8]|5.[0-8].*) CCARGS="$CCARGS -DNO_CLOSEFROM -DNO_DEV_URANDOM -DNO_FUTIMESAT -DSTREAM_CONNECTIONS";;
 		esac
-		# Somewhere NISPLUS went away.
+		# Solaris 10 added setenv(), unsetenv().
+		case $RELEASE in
+		    5.[0-9]|5.[0-9].*) CCARGS="$CCARGS -DMISSING_SETENV";;
+		esac
+		# NISPLUS was removed after Solaris 10.
 		case $RELEASE in
 		    5.[0-9][0-9]*) CCARGS="$CCARGS -DNO_NISPLUS";;
 		esac

postfix/man/man1/postalias.1

@@ -192,6 +192,10 @@ hash or btree tables.
 .IP "\fBdefault_database_type (see 'postconf -d' output)\fR"
 The default database type for use in \fBnewaliases\fR(1), \fBpostalias\fR(1)
 and \fBpostmap\fR(1) commands.
+.IP "\fBimport_environment (see 'postconf -d' output)\fR"
+The list of environment parameters that a privileged Postfix
+process will import from a non\-Postfix parent process, or name=value
+environment overrides.
 .IP "\fBsmtputf8_enable (yes)\fR"
 Enable preliminary SMTPUTF8 support for the protocols described
 in RFC 6531..6533.

postfix/man/man1/postcat.1

@@ -79,6 +79,10 @@ The text below provides only a parameter summary. See
 .IP "\fBconfig_directory (see 'postconf -d' output)\fR"
 The default location of the Postfix main.cf and master.cf
 configuration files.
+.IP "\fBimport_environment (see 'postconf -d' output)\fR"
+The list of environment parameters that a privileged Postfix
+process will import from a non\-Postfix parent process, or name=value
+environment overrides.
 .IP "\fBqueue_directory (see 'postconf -d' output)\fR"
 The location of the Postfix top\-level queue directory.
 .SH "FILES"

postfix/man/man1/postconf.1

@@ -259,8 +259,8 @@ An indexed file type based on hashing.  Available on systems
 with support for DBM databases.
 .IP \fBenviron\fR
 The UNIX process environment array. The lookup key is the
-variable name. Originally implemented for testing, someone
+environment variable name; the table name is ignored.  Originally
-may find this useful someday.
+implemented for testing, someone may find this useful someday.
 .IP \fBfail\fR
 A table that reliably fails all requests. The lookup table
 name is used for logging. This table exists to simplify

postfix/man/man1/postkick.1

@@ -65,6 +65,10 @@ configuration files.
 .IP "\fBapplication_event_drain_time (100s)\fR"
 How long the \fBpostkick\fR(1) command waits for a request to enter the
 Postfix daemon process input buffer before giving up.
+.IP "\fBimport_environment (see 'postconf -d' output)\fR"
+The list of environment parameters that a privileged Postfix
+process will import from a non\-Postfix parent process, or name=value
+environment overrides.
 .IP "\fBqueue_directory (see 'postconf -d' output)\fR"
 The location of the Postfix top\-level queue directory.
 .SH "FILES"

postfix/man/man1/postlock.1

@@ -98,6 +98,10 @@ The delay between attempts to fork() a child process.
 .IP "\fBconfig_directory (see 'postconf -d' output)\fR"
 The default location of the Postfix main.cf and master.cf
 configuration files.
+.IP "\fBimport_environment (see 'postconf -d' output)\fR"
+The list of environment parameters that a privileged Postfix
+process will import from a non\-Postfix parent process, or name=value
+environment overrides.
 .SH "SEE ALSO"
 .na
 .nf

postfix/man/man1/postlog.1

@@ -65,6 +65,10 @@ The text below provides only a parameter summary. See
 .IP "\fBconfig_directory (see 'postconf -d' output)\fR"
 The default location of the Postfix main.cf and master.cf
 configuration files.
+.IP "\fBimport_environment (see 'postconf -d' output)\fR"
+The list of environment parameters that a privileged Postfix
+process will import from a non\-Postfix parent process, or name=value
+environment overrides.
 .IP "\fBsyslog_facility (mail)\fR"
 The syslog facility of Postfix logging.
 .IP "\fBsyslog_name (see 'postconf -d' output)\fR"

postfix/man/man1/postmap.1

@@ -266,6 +266,10 @@ configuration files.
 .IP "\fBdefault_database_type (see 'postconf -d' output)\fR"
 The default database type for use in \fBnewaliases\fR(1), \fBpostalias\fR(1)
 and \fBpostmap\fR(1) commands.
+.IP "\fBimport_environment (see 'postconf -d' output)\fR"
+The list of environment parameters that a privileged Postfix
+process will import from a non\-Postfix parent process, or name=value
+environment overrides.
 .IP "\fBsmtputf8_enable (yes)\fR"
 Enable preliminary SMTPUTF8 support for the protocols described
 in RFC 6531..6533.

postfix/man/man1/postsuper.1

@@ -244,6 +244,10 @@ the hash_queue_names parameter.
 .IP "\fBhash_queue_names (deferred, defer)\fR"
 The names of queue directories that are split across multiple
 subdirectory levels.
+.IP "\fBimport_environment (see 'postconf -d' output)\fR"
+The list of environment parameters that a privileged Postfix
+process will import from a non\-Postfix parent process, or name=value
+environment overrides.
 .IP "\fBqueue_directory (see 'postconf -d' output)\fR"
 The location of the Postfix top\-level queue directory.
 .IP "\fBsyslog_facility (mail)\fR"

postfix/man/man1/sendmail.1

@@ -393,6 +393,10 @@ and \fBpostmap\fR(1) commands.
 .IP "\fBdelay_warning_time (0h)\fR"
 The time after which the sender receives a copy of the message
 headers of mail that is still queued.
+.IP "\fBimport_environment (see 'postconf -d' output)\fR"
+The list of environment parameters that a privileged Postfix
+process will import from a non\-Postfix parent process, or name=value
+environment overrides.
 .IP "\fBmail_owner (postfix)\fR"
 The UNIX system account that owns the Postfix queue and most Postfix
 daemon processes.
@@ -412,7 +416,7 @@ Postfix 3.2 and later:
 .IP "\fBalternate_config_directories (empty)\fR"
 A list of non\-default Postfix configuration directories that may
 be specified with "\-c config_directory" on the command line (in the
-case of \fBsendmail\fR(1), with \-C config_directory"), or via the MAIL_CONFIG
+case of \fBsendmail\fR(1), with "\-C config_directory"), or via the MAIL_CONFIG
 environment parameter.
 .IP "\fBmulti_instance_directories (empty)\fR"
 An optional list of non\-default Postfix configuration directories;

postfix/man/man5/postconf.5

@@ -2329,11 +2329,13 @@ Specify "ignore_mx_lookup_error = yes" to force a DNS A record
 lookup instead. This violates the SMTP standard and can result in
 mis\-delivery of mail.
 .SH import_environment (default: see "postconf \-d" output)
-The list of environment parameters that a Postfix process will
+The list of environment parameters that a privileged Postfix
-import from a non\-Postfix parent process. Examples of relevant
+process will import from a non\-Postfix parent process, or name=value
-parameters:
+environment overrides.  Unprivileged utilities will enforce the
+name=value overrides, but otherwise will not change their process
+environment.  Examples of relevant parameters:
 .IP "\fBTZ\fR"
-Needed for sane time keeping on most System\-V\-ish systems.
+May be needed for sane time keeping on most System\-V\-ish systems.
 .br
 .IP "\fBDISPLAY\fR"
 Needed for debugging Postfix daemons with an X\-windows debugger.

postfix/proto/postconf.proto

@@ -1872,17 +1872,18 @@ mis-delivery of mail.
 
 %PARAM import_environment see "postconf -d" output
 
-<p>
+<p> The list of environment parameters that a privileged Postfix
-The list of environment parameters that a Postfix process will
+process will import from a non-Postfix parent process, or name=value
-import from a non-Postfix parent process. Examples of relevant
+environment overrides.  Unprivileged utilities will enforce the
-parameters:
+name=value overrides, but otherwise will not change their process
-</p>
+environment.  Examples of relevant parameters: </p>
 
 <dl>
 
 <dt><b>TZ</b></dt>
 
-<dd>Needed for sane time keeping on most System-V-ish systems. </dd>
+<dd>May be needed for sane time keeping on most System-V-ish systems.
+</dd>
 
 <dt><b>DISPLAY</b></dt>
 

postfix/src/global/mail_conf.c

@@ -173,6 +173,16 @@ void    mail_conf_suck(void)
     char   *config_dir;
     char   *path;
 
+    /*
+     * The code below requires that all configuration directory override
+     * mechanisms set the CONF_ENV_PATH environment variable, even if the
+     * override was specified via the command line. This reduces the number
+     * of pathways that need to be checked for possible security attacks.
+     * 
+     * Note: this code necessarily runs before cleanenv() can enforce the
+     * import_environment scrubbing policy.
+     */
+
     /*
      * Permit references to unknown configuration variable names. We rely on
      * a separate configuration checking tool to spot misspelled names and
@@ -191,8 +201,7 @@ void    mail_conf_suck(void)
      * domain, require that it is listed in the default main.cf file.
      */
     if (strcmp(var_config_dir, DEF_CONFIG_DIR) != 0	/* non-default */
-	&& safe_getenv(CONF_ENV_PATH) == 0	/* non-default */
+	&& unsafe())				/* untrusted env and cli */
-	&& geteuid() != 0)			/* untrusted */
 	mail_conf_checkdir(var_config_dir);
     path = concatenate(var_config_dir, "/", "main.cf", (char *) 0);
     if (dict_load_file_xt(CONFIG_DICT, path) == 0)

postfix/src/global/mail_parm_split.c

@@ -56,14 +56,6 @@
 #include <mail_params.h>
 #include <mail_parm_split.h>
 
- /*
-  * While testing, do not terminate the program after a syntax error.
-  */
-#ifdef TEST
-#undef msg_fatal
-#define msg_fatal msg_warn
-#endif
-
 /* mail_parm_split - split list, extract {text}, errors are fatal */
 
 ARGV   *mail_parm_split(const char *name, const char *value)
@@ -72,7 +64,7 @@ ARGV   *mail_parm_split(const char *name, const char *value)
     char   *saved_string = mystrdup(value);
     char   *bp = saved_string;
     char   *arg;
-    const char *err;
+    char   *err;
 
     /*
      * The code that detects the error shall either signal or handle the
@@ -81,8 +73,14 @@ ARGV   *mail_parm_split(const char *name, const char *value)
      */
     while ((arg = mystrtokq(&bp, CHARS_COMMA_SP, CHARS_BRACE)) != 0) {
 	if (*arg == CHARS_BRACE[0]
-	    && (err = extpar(&arg, CHARS_BRACE, EXTPAR_FLAG_STRIP)) != 0)
+	    && (err = extpar(&arg, CHARS_BRACE, EXTPAR_FLAG_STRIP)) != 0) {
+#ifndef TEST
 	    msg_fatal("%s: %s", name, err);
+#else
+	    msg_warn("%s: %s", name, err);
+	    myfree(err);
+#endif
+	}
 	argv_add(argvp, arg, (char *) 0);
     }
     argv_terminate(argvp);

postfix/src/global/mail_version.h

@@ -20,7 +20,7 @@
   * Patches change both the patchlevel and the release date. Snapshots have no
   * patchlevel; they change the release date only.
   */
-#define MAIL_RELEASE_DATE	"20170129"
+#define MAIL_RELEASE_DATE	"20170206"
 #define MAIL_VERSION_NUMBER	"3.2"
 
 #ifdef SNAPSHOT

postfix/src/postalias/Makefile.in

@@ -28,33 +28,35 @@ tests:	test1 test2 fail_test
 root_tests:
 
 test1:	$(PROG) map.in map-abc1.ref map-ghi1.ref map-uABC1.ref
-	./$(PROG) map.in
+	${SHLIB_ENV} ${VALGRIND} ./$(PROG) map.in
 	for key in abc ghi; \
 	do \
-	    ./$(PROG) -q $${key} map.in | diff map-$${key}1.ref -; \
+	    ${SHLIB_ENV} ${VALGRIND} ./$(PROG) -q $${key} map.in | diff map-$${key}1.ref -; \
 	done
-	./$(PROG) -f map.in
+	${SHLIB_ENV} ${VALGRIND} ./$(PROG) -f map.in
 	for key in ABC; \
 	do \
-	    ./$(PROG) -fq $${key} map.in | diff map-u$${key}1.ref -; \
+	    ${SHLIB_ENV} ${VALGRIND} ./$(PROG) -fq $${key} map.in | diff map-u$${key}1.ref -; \
 	done
 	rm -f map.in.db
 
 test2:	$(PROG) map.in map-abc2.ref map-ghi2.ref map-uABC2.ref
-	./$(PROG) map.in
+	${SHLIB_ENV} ${VALGRIND} ./$(PROG) map.in
 	for key in abc ghi; \
 	do \
-	    echo $${key} | ./$(PROG) -q - map.in | diff map-$${key}2.ref -; \
+	    echo $${key} | ${SHLIB_ENV} ${VALGRIND} ./$(PROG) -q - map.in | diff map-$${key}2.ref -; \
 	done
-	./$(PROG) -f map.in
+	${SHLIB_ENV} ${VALGRIND} ./$(PROG) -f map.in
 	for key in ABC; \
 	do \
-	    echo $${key} | ./$(PROG) -fq - map.in | diff map-u$${key}2.ref -; \
+	    echo $${key} | ${SHLIB_ENV} ${VALGRIND} ./$(PROG) -fq - map.in | diff map-u$${key}2.ref -; \
 	done
 	rm -f map.in.db
 
 fail_test: $(PROG) aliases fail_test.in fail_test.ref
-	-(sh fail_test.in 2>&1 || exit 0) | sed 's/No error:/Unknown error:/' > fail_test.tmp
+	-(${SHLIB_ENV} sh fail_test.in 2>&1 || exit 0) | sed \
+	    -e 's/No error:/Unknown error:/' \
+	    -e 's/Success/Unknown error: 0/' > fail_test.tmp
 	diff fail_test.ref fail_test.tmp
 	rm -f fail_test.tmp
 
@@ -89,11 +91,13 @@ depend: $(MAKES)
 # do not edit below this line - it is generated by 'make depend'
 postalias.o: ../../include/argv.h
 postalias.o: ../../include/check_arg.h
+postalias.o: ../../include/clean_env.h
 postalias.o: ../../include/dict.h
 postalias.o: ../../include/dict_proxy.h
 postalias.o: ../../include/mail_conf.h
 postalias.o: ../../include/mail_dict.h
 postalias.o: ../../include/mail_params.h
+postalias.o: ../../include/mail_parm_split.h
 postalias.o: ../../include/mail_task.h
 postalias.o: ../../include/mail_version.h
 postalias.o: ../../include/mkmap.h

postfix/src/postalias/fail_test.in

@@ -1,7 +1,7 @@
-./postalias -q xx fail:aliases
+${VALGRIND} ./postalias -q xx fail:aliases
-echo xx | ./postalias -q - fail:aliases
+echo xx | ${VALGRIND} ./postalias -q - fail:aliases
-./postalias -d xx fail:aliases
+${VALGRIND} ./postalias -d xx fail:aliases
-echo xx | ./postalias -d - fail:aliases
+echo xx | ${VALGRIND} ./postalias -d - fail:aliases
-./postalias -s fail:aliases
+${VALGRIND} ./postalias -s fail:aliases
-./postalias -i fail:aliases < aliases
+${VALGRIND} ./postalias -i fail:aliases < aliases
-./postalias fail:aliases
+${VALGRIND} ./postalias fail:aliases

postfix/src/postalias/postalias.c

@@ -180,6 +180,10 @@
 /* .IP "\fBdefault_database_type (see 'postconf -d' output)\fR"
 /*	The default database type for use in \fBnewaliases\fR(1), \fBpostalias\fR(1)
 /*	and \fBpostmap\fR(1) commands.
+/* .IP "\fBimport_environment (see 'postconf -d' output)\fR"
+/*	The list of environment parameters that a privileged Postfix
+/*	process will import from a non-Postfix parent process, or name=value
+/*	environment overrides.
 /* .IP "\fBsmtputf8_enable (yes)\fR"
 /*	Enable preliminary SMTPUTF8 support for the protocols described
 /*	in RFC 6531..6533.
@@ -246,6 +250,7 @@
 #include <vstring_vstream.h>
 #include <set_eugid.h>
 #include <warn_stat.h>
+#include <clean_env.h>
 
 /* Global library. */
 
@@ -257,6 +262,7 @@
 #include <mkmap.h>
 #include <mail_task.h>
 #include <dict_proxy.h>
+#include <mail_parm_split.h>
 
 /* Application-specific. */
 
@@ -700,6 +706,7 @@ int     main(int argc, char **argv)
     char   *delkey = 0;
     int     sequence = 0;
     int     found;
+    ARGV   *import_env;
 
     /*
      * Fingerprint executables and core dumps.
@@ -806,6 +813,10 @@ int     main(int argc, char **argv)
 	}
     }
     mail_conf_read();
+    /* Enforce consistent operation of different Postfix parts. */
+    import_env = mail_parm_split(VAR_IMPORT_ENVIRON, var_import_environ);
+    update_env(import_env->argv);
+    argv_free(import_env);
     /* Re-evaluate mail_task() after reading main.cf. */
     msg_syslog_init(mail_task(argv[0]), LOG_PID, LOG_FACILITY);
     mail_dict_init();

postfix/src/postcat/Makefile.in

@@ -98,14 +98,17 @@ depend: $(MAKES)
 	@$(EXPORT) make -f Makefile.in Makefile 1>&2
 
 # do not edit below this line - it is generated by 'make depend'
+postcat.o: ../../include/argv.h
 postcat.o: ../../include/attr.h
 postcat.o: ../../include/check_arg.h
+postcat.o: ../../include/clean_env.h
 postcat.o: ../../include/htable.h
 postcat.o: ../../include/iostuff.h
 postcat.o: ../../include/is_header.h
 postcat.o: ../../include/lex_822.h
 postcat.o: ../../include/mail_conf.h
 postcat.o: ../../include/mail_params.h
+postcat.o: ../../include/mail_parm_split.h
 postcat.o: ../../include/mail_proto.h
 postcat.o: ../../include/mail_queue.h
 postcat.o: ../../include/mail_version.h

postfix/src/postcat/postcat.c

@@ -67,6 +67,10 @@
 /* .IP "\fBconfig_directory (see 'postconf -d' output)\fR"
 /*	The default location of the Postfix main.cf and master.cf
 /*	configuration files.
+/* .IP "\fBimport_environment (see 'postconf -d' output)\fR"
+/*	The list of environment parameters that a privileged Postfix
+/*	process will import from a non-Postfix parent process, or name=value
+/*	environment overrides.
 /* .IP "\fBqueue_directory (see 'postconf -d' output)\fR"
 /*	The location of the Postfix top-level queue directory.
 /* FILES
@@ -110,6 +114,7 @@
 #include <vstring_vstream.h>
 #include <stringops.h>
 #include <warn_stat.h>
+#include <clean_env.h>
 
 /* Global library. */
 
@@ -122,6 +127,7 @@
 #include <mail_proto.h>
 #include <is_header.h>
 #include <lex_822.h>
+#include <mail_parm_split.h>
 
 /* Application-specific. */
 
@@ -424,6 +430,7 @@ int     main(int argc, char **argv)
     };
     char  **cpp;
     int     tries;
+    ARGV   *import_env;
 
     /*
      * Fingerprint executables and core dumps.
@@ -486,6 +493,9 @@ int     main(int argc, char **argv)
      * Further initialization...
      */
     mail_conf_read();
+    import_env = mail_parm_split(VAR_IMPORT_ENVIRON, var_import_environ);
+    update_env(import_env->argv);
+    argv_free(import_env);
 
     /*
      * Initialize.

postfix/src/postconf/Makefile.in

@@ -36,7 +36,7 @@ $(PROG): $(OBJS) $(LIBS)
 	rm -f $@
 	(echo "# DO NOT EDIT THIS FILE. EDIT THE MAIN.CF FILE INSTEAD. THE"; \
 	 echo "# TEXT HERE JUST SHOWS DEFAULT SETTINGS BUILT INTO POSTFIX."; \
-	 echo "#"; $(SHLIB_ENV) $(SHLIB_ENV) ./$(PROG) -d -c ../../conf) | \
+	 echo "#"; $(SHLIB_ENV) ./$(PROG) -d -c ../../conf) | \
 	    egrep -v '^(myhostname|mydomain|mynetworks|process_name|process_id) ' >$@
 
 $(OBJS): ../../conf/makedefs.out
@@ -52,7 +52,7 @@ tests: test1 test2 test3 test4 test5 test6 test7 test8 test9 test10 test11 \
 	test31 test32 test33 test34 test35 test36 test37 test39 test40 test41 \
 	test42 test43 test44 test45 test46 test47 test48 test49 test50 test51 \
 	test52 test53 test54 test55 test56 test57 test58 test59 test60 test61 \
-	test62 test63
+	test62 test63 test64 test65
 
 root_tests:
 
@@ -848,6 +848,28 @@ test63: $(PROG) test63.ref
 	diff test63.ref test63.tmp
 	rm -f main.cf master.cf test63.tmp
 
+# main.cf overrides built-in default.
+
+test64: $(PROG) test64.ref
+	rm -f main.cf master.cf
+	touch main.cf master.cf
+	echo 'relayhost = relay-from-main.cf' >> main.cf
+	touch -t 197101010000 main.cf
+	$(SHLIB_ENV) ./$(PROG) -c. relayhost >test64.tmp 2>&1
+	diff test64.ref test64.tmp
+	rm -f main.cf master.cf test64.tmp
+
+# '-o name=value' overrides main.cf.
+
+test65: $(PROG) test65.ref
+	rm -f main.cf master.cf
+	touch main.cf master.cf
+	echo 'relayhost = relay-from-main.cf' >> main.cf
+	touch -t 197101010000 main.cf
+	$(SHLIB_ENV) ./$(PROG) -c. -o relayhost=relay-from-cmd-line relayhost >test65.tmp 2>&1
+	diff test65.ref test65.tmp
+	rm -f main.cf master.cf test65.tmp
+
 printfck: $(OBJS) $(PROG)
 	rm -rf printfck
 	mkdir printfck

postfix/src/postconf/postconf.c

@@ -253,8 +253,8 @@
 /*	with support for DBM databases.
 /* .IP \fBenviron\fR
 /*	The UNIX process environment array. The lookup key is the
-/*	variable name. Originally implemented for testing, someone
+/*	environment variable name; the table name is ignored.  Originally
-/*	may find this useful someday.
+/*	implemented for testing, someone may find this useful someday.
 /* .IP \fBfail\fR
 /*	A table that reliably fails all requests. The lookup table
 /*	name is used for logging. This table exists to simplify
@@ -919,6 +919,20 @@ int     main(int argc, char **argv)
 	}
     }
 
+    /*
+     * We don't enforce import_environment consistency in this program.
+     * 
+     * We don't extract import_environment from main.cf, because the postconf
+     * command must be able to extract parameter settings from main.cf before
+     * all installation parameters such as mail_owner or setgid_group have a
+     * legitimate value.
+     * 
+     * We would need the functionality of mail_params_init() including all the
+     * side effects of populating the CONFIG_DICT with default values so that
+     * $name expansion works correctly, but excluding all the parameter value
+     * sanity checks so that it would not abort at installation time.
+     */
+
     /*
      * Make all options explicit, before checking their compatibility.
      */

postfix/src/postconf/test64.ref

@@ -0,0 +1 @@
+relayhost = relay-from-main.cf

postfix/src/postconf/test65.ref

@@ -0,0 +1 @@
+relayhost = relay-from-cmd-line

postfix/src/postkick/Makefile.in

@@ -58,13 +58,16 @@ depend: $(MAKES)
 	@$(EXPORT) make -f Makefile.in Makefile 1>&2
 
 # do not edit below this line - it is generated by 'make depend'
+postkick.o: ../../include/argv.h
 postkick.o: ../../include/attr.h
 postkick.o: ../../include/check_arg.h
+postkick.o: ../../include/clean_env.h
 postkick.o: ../../include/events.h
 postkick.o: ../../include/htable.h
 postkick.o: ../../include/iostuff.h
 postkick.o: ../../include/mail_conf.h
 postkick.o: ../../include/mail_params.h
+postkick.o: ../../include/mail_parm_split.h
 postkick.o: ../../include/mail_proto.h
 postkick.o: ../../include/mail_version.h
 postkick.o: ../../include/msg.h

postfix/src/postkick/postkick.c

@@ -53,6 +53,10 @@
 /* .IP "\fBapplication_event_drain_time (100s)\fR"
 /*	How long the \fBpostkick\fR(1) command waits for a request to enter the
 /*	Postfix daemon process input buffer before giving up.
+/* .IP "\fBimport_environment (see 'postconf -d' output)\fR"
+/*	The list of environment parameters that a privileged Postfix
+/*	process will import from a non-Postfix parent process, or name=value
+/*	environment overrides.
 /* .IP "\fBqueue_directory (see 'postconf -d' output)\fR"
 /*	The location of the Postfix top-level queue directory.
 /* FILES
@@ -97,6 +101,7 @@
 #include <safe.h>
 #include <events.h>
 #include <warn_stat.h>
+#include <clean_env.h>
 
 /* Global library. */
 
@@ -104,6 +109,7 @@
 #include <mail_params.h>
 #include <mail_version.h>
 #include <mail_conf.h>
+#include <mail_parm_split.h>
 
 static NORETURN usage(char *myname)
 {
@@ -121,6 +127,7 @@ int     main(int argc, char **argv)
     struct stat st;
     char   *slash;
     int     c;
+    ARGV   *import_env;
 
     /*
      * Fingerprint executables and core dumps.
@@ -178,6 +185,10 @@ int     main(int argc, char **argv)
      * Finish initializations.
      */
     mail_conf_read();
+    /* Enforce consistent operation of different Postfix parts. */
+    import_env = mail_parm_split(VAR_IMPORT_ENVIRON, var_import_environ);
+    update_env(import_env->argv);
+    argv_free(import_env);
     if (chdir(var_queue_dir))
 	msg_fatal("chdir %s: %m", var_queue_dir);
 

postfix/src/postlock/Makefile.in

@@ -60,6 +60,7 @@ depend: $(MAKES)
 # do not edit below this line - it is generated by 'make depend'
 postlock.o: ../../include/argv.h
 postlock.o: ../../include/check_arg.h
+postlock.o: ../../include/clean_env.h
 postlock.o: ../../include/deliver_flock.h
 postlock.o: ../../include/dot_lockfile.h
 postlock.o: ../../include/dsn.h
@@ -68,6 +69,7 @@ postlock.o: ../../include/dsn_util.h
 postlock.o: ../../include/iostuff.h
 postlock.o: ../../include/mail_conf.h
 postlock.o: ../../include/mail_params.h
+postlock.o: ../../include/mail_parm_split.h
 postlock.o: ../../include/mail_version.h
 postlock.o: ../../include/mbox_conf.h
 postlock.o: ../../include/mbox_open.h

postfix/src/postlock/postlock.c

@@ -78,6 +78,10 @@
 /* .IP "\fBconfig_directory (see 'postconf -d' output)\fR"
 /*	The default location of the Postfix main.cf and master.cf
 /*	configuration files.
+/* .IP "\fBimport_environment (see 'postconf -d' output)\fR"
+/*	The list of environment parameters that a privileged Postfix
+/*	process will import from a non-Postfix parent process, or name=value
+/*	environment overrides.
 /* SEE ALSO
 /*	postconf(5), configuration parameters
 /* LICENSE
@@ -114,6 +118,7 @@
 #include <msg_vstream.h>
 #include <iostuff.h>
 #include <warn_stat.h>
+#include <clean_env.h>
 
 /* Global library. */
 
@@ -126,6 +131,7 @@
 #include <mbox_conf.h>
 #include <mbox_open.h>
 #include <dsn_util.h>
+#include <mail_parm_split.h>
 
 /* Application-specific. */
 
@@ -161,6 +167,7 @@ int     main(int argc, char **argv)
     int     lock_mask;
     char   *lock_style = 0;
     MBOX   *mp;
+    ARGV   *import_env;
 
     /*
      * Fingerprint executables and core dumps.
@@ -226,6 +233,10 @@ int     main(int argc, char **argv)
      * configured lock style.
      */
     mail_conf_read();
+    /* Enforce consistent operation of different Postfix parts. */
+    import_env = mail_parm_split(VAR_IMPORT_ENVIRON, var_import_environ);
+    update_env(import_env->argv);
+    argv_free(import_env);
     lock_mask = mbox_lock_mask(lock_style ? lock_style :
 	       get_mail_conf_str(VAR_MAILBOX_LOCK, DEF_MAILBOX_LOCK, 1, 0));
 

postfix/src/postlog/Makefile.in

@@ -62,9 +62,12 @@ depend: $(MAKES)
 	@$(EXPORT) make -f Makefile.in Makefile 1>&2
 
 # do not edit below this line - it is generated by 'make depend'
+postlog.o: ../../include/argv.h
 postlog.o: ../../include/check_arg.h
+postlog.o: ../../include/clean_env.h
 postlog.o: ../../include/mail_conf.h
 postlog.o: ../../include/mail_params.h
+postlog.o: ../../include/mail_parm_split.h
 postlog.o: ../../include/mail_task.h
 postlog.o: ../../include/mail_version.h
 postlog.o: ../../include/msg.h

postfix/src/postlog/postlog.c

@@ -55,6 +55,10 @@
 /* .IP "\fBconfig_directory (see 'postconf -d' output)\fR"
 /*	The default location of the Postfix main.cf and master.cf
 /*	configuration files.
+/* .IP "\fBimport_environment (see 'postconf -d' output)\fR"
+/*	The list of environment parameters that a privileged Postfix
+/*	process will import from a non-Postfix parent process, or name=value
+/*	environment overrides.
 /* .IP "\fBsyslog_facility (mail)\fR"
 /*	The syslog facility of Postfix logging.
 /* .IP "\fBsyslog_name (see 'postconf -d' output)\fR"
@@ -103,6 +107,7 @@
 #include <msg_vstream.h>
 #include <msg_syslog.h>
 #include <warn_stat.h>
+#include <clean_env.h>
 
 /* Global library. */
 
@@ -110,6 +115,7 @@
 #include <mail_version.h>
 #include <mail_conf.h>
 #include <mail_task.h>
+#include <mail_parm_split.h>
 
 /* Application-specific. */
 
@@ -183,6 +189,7 @@ int     main(int argc, char **argv)
     const char *tag;
     int     log_flags = 0;
     int     level = MSG_INFO;
+    ARGV   *import_env;
 
     /*
      * Fingerprint executables and core dumps.
@@ -250,6 +257,10 @@ int     main(int argc, char **argv)
      * may require that mail_task() be re-evaluated.
      */
     mail_conf_read();
+    /* Enforce consistent operation of different Postfix parts. */
+    import_env = mail_parm_split(VAR_IMPORT_ENVIRON, var_import_environ);
+    update_env(import_env->argv);
+    argv_free(import_env);
     if (tag == 0)
 	tag = mail_task(argv[0]);
 

postfix/src/postmap/Makefile.in

@@ -97,12 +97,14 @@ depend: $(MAKES)
 # do not edit below this line - it is generated by 'make depend'
 postmap.o: ../../include/argv.h
 postmap.o: ../../include/check_arg.h
+postmap.o: ../../include/clean_env.h
 postmap.o: ../../include/dict.h
 postmap.o: ../../include/dict_proxy.h
 postmap.o: ../../include/header_opts.h
 postmap.o: ../../include/mail_conf.h
 postmap.o: ../../include/mail_dict.h
 postmap.o: ../../include/mail_params.h
+postmap.o: ../../include/mail_parm_split.h
 postmap.o: ../../include/mail_task.h
 postmap.o: ../../include/mail_version.h
 postmap.o: ../../include/mime_state.h

postfix/src/postmap/fail_test.in

@@ -1,8 +1,8 @@
-./postmap -q xx fail:aliases
+${VALGRIND} ./postmap -q xx fail:aliases
-echo xx | ./postmap -q - fail:aliases
+echo xx | ${VALGRIND} ./postmap -q - fail:aliases
-echo xx | ./postmap -bq - fail:aliases
+echo xx | ${VALGRIND} ./postmap -bq - fail:aliases
-./postmap -d xx fail:aliases
+${VALGRIND} ./postmap -d xx fail:aliases
-echo xx | ./postmap -d - fail:aliases
+echo xx | ${VALGRIND} ./postmap -d - fail:aliases
-./postmap -s fail:aliases
+${VALGRIND} ./postmap -s fail:aliases
-./postmap -i fail:aliases < aliases
+${VALGRIND} ./postmap -i fail:aliases < aliases
-./postmap fail:aliases
+${VALGRIND} ./postmap fail:aliases

postfix/src/postmap/postmap.c

@@ -250,6 +250,10 @@
 /* .IP "\fBdefault_database_type (see 'postconf -d' output)\fR"
 /*	The default database type for use in \fBnewaliases\fR(1), \fBpostalias\fR(1)
 /*	and \fBpostmap\fR(1) commands.
+/* .IP "\fBimport_environment (see 'postconf -d' output)\fR"
+/*	The list of environment parameters that a privileged Postfix
+/*	process will import from a non-Postfix parent process, or name=value
+/*	environment overrides.
 /* .IP "\fBsmtputf8_enable (yes)\fR"
 /*	Enable preliminary SMTPUTF8 support for the protocols described
 /*	in RFC 6531..6533.
@@ -311,6 +315,7 @@
 #include <vstring_vstream.h>
 #include <set_eugid.h>
 #include <warn_stat.h>
+#include <clean_env.h>
 
 /* Global library. */
 
@@ -323,6 +328,7 @@
 #include <dict_proxy.h>
 #include <mime_state.h>
 #include <rec_type.h>
+#include <mail_parm_split.h>
 
 /* Application-specific. */
 
@@ -857,6 +863,7 @@ int     main(int argc, char **argv)
     int     sequence = 0;
     int     found;
     int     force_utf8 = 0;
+    ARGV   *import_env;
 
     /*
      * Fingerprint executables and core dumps.
@@ -975,6 +982,10 @@ int     main(int argc, char **argv)
 	}
     }
     mail_conf_read();
+    /* Enforce consistent operation of different Postfix parts. */
+    import_env = mail_parm_split(VAR_IMPORT_ENVIRON, var_import_environ);
+    update_env(import_env->argv);
+    argv_free(import_env);
     /* Re-evaluate mail_task() after reading main.cf. */
     msg_syslog_init(mail_task(argv[0]), LOG_PID, LOG_FACILITY);
     mail_dict_init();

postfix/src/postmap/quote_test.in

@@ -1,8 +1,8 @@
-echo '"aa bb" cc' | ./postmap -i quote_test_map || exit 1
+echo '"aa bb" cc' | ${VALGRIND} ./postmap -i quote_test_map || exit 1
-echo '"dd ee ff' | ./postmap -i quote_test_map || exit 1
+echo '"dd ee ff' | ${VALGRIND} ./postmap -i quote_test_map || exit 1
-echo 'gg\ hh ii' | ./postmap -i quote_test_map || exit 1
+echo 'gg\ hh ii' | ${VALGRIND} ./postmap -i quote_test_map || exit 1
-echo '"gg\"hh" ii' | ./postmap -i quote_test_map || exit 1
+echo '"gg\"hh" ii' | ${VALGRIND} ./postmap -i quote_test_map || exit 1
-echo '"jj@kk" ll' | ./postmap -i quote_test_map || exit 1
+echo '"jj@kk" ll' | ${VALGRIND} ./postmap -i quote_test_map || exit 1
-echo 'mm@nn@oo pp' | ./postmap -i quote_test_map || exit 1
+echo 'mm@nn@oo pp' | ${VALGRIND} ./postmap -i quote_test_map || exit 1
-echo '@oo pp' | ./postmap -i quote_test_map || exit 1
+echo '@oo pp' | ${VALGRIND} ./postmap -i quote_test_map || exit 1
-./postmap -s quote_test_map | LC_ALL=C sort
+${VALGRIND} ./postmap -s quote_test_map | LC_ALL=C sort

postfix/src/postsuper/Makefile.in

@@ -60,10 +60,12 @@ depend: $(MAKES)
 # do not edit below this line - it is generated by 'make depend'
 postsuper.o: ../../include/argv.h
 postsuper.o: ../../include/check_arg.h
+postsuper.o: ../../include/clean_env.h
 postsuper.o: ../../include/file_id.h
 postsuper.o: ../../include/mail_conf.h
 postsuper.o: ../../include/mail_open_ok.h
 postsuper.o: ../../include/mail_params.h
+postsuper.o: ../../include/mail_parm_split.h
 postsuper.o: ../../include/mail_queue.h
 postsuper.o: ../../include/mail_task.h
 postsuper.o: ../../include/mail_version.h

postfix/src/postsuper/postsuper.c

@@ -230,6 +230,10 @@
 /* .IP "\fBhash_queue_names (deferred, defer)\fR"
 /*	The names of queue directories that are split across multiple
 /*	subdirectory levels.
+/* .IP "\fBimport_environment (see 'postconf -d' output)\fR"
+/*	The list of environment parameters that a privileged Postfix
+/*	process will import from a non-Postfix parent process, or name=value
+/*	environment overrides.
 /* .IP "\fBqueue_directory (see 'postconf -d' output)\fR"
 /*	The location of the Postfix top-level queue directory.
 /* .IP "\fBsyslog_facility (mail)\fR"
@@ -288,6 +292,7 @@
 #include <sane_fsops.h>
 #include <myrand.h>
 #include <warn_stat.h>
+#include <clean_env.h>
 
 /* Global library. */
 
@@ -299,6 +304,7 @@
 #include <mail_queue.h>
 #include <mail_open_ok.h>
 #include <file_id.h>
+#include <mail_parm_split.h>
 
 /* Application-specific. */
 
@@ -1080,6 +1086,7 @@ int     main(int argc, char **argv)
     ARGV   *hold_names = 0;
     ARGV   *release_names = 0;
     char  **cpp;
+    ARGV   *import_env;
 
     /*
      * Defaults. The structural checks must fix the directory levels of "log
@@ -1230,6 +1237,10 @@ int     main(int argc, char **argv)
      * configuration directory location.
      */
     mail_conf_read();
+    /* Enforce consistent operation of different Postfix parts. */
+    import_env = mail_parm_split(VAR_IMPORT_ENVIRON, var_import_environ);
+    clean_env(import_env->argv);
+    argv_free(import_env);
     /* Re-evaluate mail_task() after reading main.cf. */
     msg_syslog_init(mail_task(argv[0]), LOG_PID, LOG_FACILITY);
     if (chdir(var_queue_dir))

postfix/src/posttls-finger/Makefile.in

@@ -65,6 +65,7 @@ depend: $(MAKES)
 posttls-finger.o: ../../include/argv.h
 posttls-finger.o: ../../include/check_arg.h
 posttls-finger.o: ../../include/chroot_uid.h
+posttls-finger.o: ../../include/clean_env.h
 posttls-finger.o: ../../include/dns.h
 posttls-finger.o: ../../include/dsn.h
 posttls-finger.o: ../../include/dsn_buf.h
@@ -73,6 +74,7 @@ posttls-finger.o: ../../include/inet_proto.h
 posttls-finger.o: ../../include/iostuff.h
 posttls-finger.o: ../../include/mail_conf.h
 posttls-finger.o: ../../include/mail_params.h
+posttls-finger.o: ../../include/mail_parm_split.h
 posttls-finger.o: ../../include/mail_server.h
 posttls-finger.o: ../../include/midna_domain.h
 posttls-finger.o: ../../include/msg.h

postfix/src/posttls-finger/posttls-finger.c

@@ -345,6 +345,7 @@
 #include <myaddrinfo.h>
 #include <sock_addr.h>
 #include <midna_domain.h>
+#include <clean_env.h>
 
 #define STR(x)		vstring_str(x)
 
@@ -355,6 +356,7 @@
 #include <mail_conf.h>
 #include <smtp_stream.h>
 #include <dsn_buf.h>
+#include <mail_parm_split.h>
 
 /* DNS library. */
 
@@ -1919,6 +1921,7 @@ int     main(int argc, char *argv[])
     static STATE state;
     char   *loopenv = getenv("VALGRINDLOOP");
     int     loop = loopenv ? atoi(loopenv) : 1;
+    ARGV   *import_env;
 
     /* Don't die when a peer goes away unexpectedly. */
     signal(SIGPIPE, SIG_IGN);
@@ -1937,6 +1940,11 @@ int     main(int argc, char *argv[])
     mail_params_init();
     parse_tas(&state);
 
+    /* Enforce consistent operation of different Postfix parts. */
+    import_env = mail_parm_split(VAR_IMPORT_ENVIRON, var_import_environ);
+    update_env(import_env->argv);
+    argv_free(import_env);
+
     argc -= optind;
     argv += optind;
 

postfix/src/sendmail/Makefile.in

@@ -61,6 +61,7 @@ depend: $(MAKES)
 sendmail.o: ../../include/argv.h
 sendmail.o: ../../include/attr.h
 sendmail.o: ../../include/check_arg.h
+sendmail.o: ../../include/clean_env.h
 sendmail.o: ../../include/cleanup_user.h
 sendmail.o: ../../include/connect.h
 sendmail.o: ../../include/debug_process.h
@@ -74,6 +75,7 @@ sendmail.o: ../../include/iostuff.h
 sendmail.o: ../../include/mail_conf.h
 sendmail.o: ../../include/mail_flush.h
 sendmail.o: ../../include/mail_params.h
+sendmail.o: ../../include/mail_parm_split.h
 sendmail.o: ../../include/mail_proto.h
 sendmail.o: ../../include/mail_queue.h
 sendmail.o: ../../include/mail_run.h

postfix/src/sendmail/sendmail.c

@@ -365,6 +365,10 @@
 /* .IP "\fBdelay_warning_time (0h)\fR"
 /*	The time after which the sender receives a copy of the message
 /*	headers of mail that is still queued.
+/* .IP "\fBimport_environment (see 'postconf -d' output)\fR"
+/*	The list of environment parameters that a privileged Postfix
+/*	process will import from a non-Postfix parent process, or name=value
+/*	environment overrides.
 /* .IP "\fBmail_owner (postfix)\fR"
 /*	The UNIX system account that owns the Postfix queue and most Postfix
 /*	daemon processes.
@@ -384,7 +388,7 @@
 /* .IP "\fBalternate_config_directories (empty)\fR"
 /*	A list of non-default Postfix configuration directories that may
 /*	be specified with "-c config_directory" on the command line (in the
-/*	case of \fBsendmail\fR(1), with -C config_directory"), or via the MAIL_CONFIG
+/*	case of \fBsendmail\fR(1), with "-C config_directory"), or via the MAIL_CONFIG
 /*	environment parameter.
 /* .IP "\fBmulti_instance_directories (empty)\fR"
 /*	An optional list of non-default Postfix configuration directories;
@@ -468,6 +472,7 @@
 #include <split_at.h>
 #include <name_code.h>
 #include <warn_stat.h>
+#include <clean_env.h>
 
 /* Global library. */
 
@@ -492,6 +497,7 @@
 #include <header_opts.h>
 #include <user_acl.h>
 #include <dsn_mask.h>
+#include <mail_parm_split.h>
 
 /* Application-specific. */
 
@@ -1001,6 +1007,7 @@ int     main(int argc, char **argv)
     int     dsn_ret = 0;
     const char *dsn_envid = 0;
     int     saved_optind;
+    ARGV   *import_env;
 
     /*
      * Fingerprint executables and core dumps.
@@ -1099,6 +1106,10 @@ int     main(int argc, char **argv)
     }
     optind = saved_optind;
     mail_conf_read();
+    /* Enforce consistent operation of different Postfix parts.	 */
+    import_env = mail_parm_split(VAR_IMPORT_ENVIRON, var_import_environ);
+    update_env(import_env->argv);
+    argv_free(import_env);
     /* Re-evaluate mail_task() after reading main.cf. */
     msg_syslog_init(mail_task("sendmail"), LOG_PID, LOG_FACILITY);
     get_mail_conf_str_table(str_table);

postfix/src/smtpd/smtpd_check.c

@@ -2957,7 +2957,7 @@ static int check_server_access(SMTPD_STATE *state, const char *table,
 	const char *bare_addr;
 	ssize_t len;
 
-	if (type != T_MX)
+	if (type != T_A && type != T_MX)
 	    return (SMTPD_CHECK_DUNNO);
 	len = strlen(domain);
 	if (domain[len - 1] != ']')

postfix/src/util/Makefile.in

@@ -546,148 +546,148 @@ tests: all valid_hostname_test mac_expand_test dict_test unescape_test \
 root_tests:
 
 valid_hostname_test: valid_hostname valid_hostname.in valid_hostname.ref
-	$(SHLIB_ENV) ./valid_hostname <valid_hostname.in 2>valid_hostname.tmp
+	$(SHLIB_ENV) ${VALGRIND} ./valid_hostname <valid_hostname.in 2>valid_hostname.tmp
 	diff valid_hostname.ref valid_hostname.tmp
 	rm -f valid_hostname.tmp
 
 mac_expand_test: mac_expand mac_expand.in mac_expand.ref
-	$(SHLIB_ENV) ./mac_expand <mac_expand.in >mac_expand.tmp 2>&1
+	$(SHLIB_ENV) ${VALGRIND} ./mac_expand <mac_expand.in >mac_expand.tmp 2>&1
 	diff mac_expand.ref mac_expand.tmp
 	rm -f mac_expand.tmp
 
 unescape_test: unescape unescape.in unescape.ref
-	$(SHLIB_ENV) ./unescape <unescape.in | od -cb >unescape.tmp
+	$(SHLIB_ENV) ${VALGRIND} ./unescape <unescape.in | od -cb >unescape.tmp
 	diff -b unescape.ref unescape.tmp
-#	$(SHLIB_ENV) ./unescape <unescape.in | $(SHLIB_ENV) ./unescape -e >unescape.tmp
+#	$(SHLIB_ENV) ${VALGRIND} ./unescape <unescape.in | $(SHLIB_ENV) ./unescape -e >unescape.tmp
 #	diff unescape.in unescape.tmp
 	rm -f unescape.tmp
 
 hex_quote_test: hex_quote
-	$(SHLIB_ENV) ./hex_quote <hex_quote.c | od -cb >hex_quote.tmp
+	$(SHLIB_ENV) ${VALGRIND} ./hex_quote <hex_quote.c | od -cb >hex_quote.tmp
 	od -cb <hex_quote.c >hex_quote.ref
 	cmp hex_quote.ref hex_quote.tmp
 	rm -f hex_quote.ref hex_quote.tmp
 
 ctable_test: ctable
-	$(SHLIB_ENV) ./ctable <ctable.in >ctable.tmp 2>&1
+	$(SHLIB_ENV) ${VALGRIND} ./ctable <ctable.in >ctable.tmp 2>&1
 	diff ctable.ref ctable.tmp
 	rm -f ctable.tmp
 
 # On Linux, following test may require "modprobe ipv6" to enable IPv6.
 
 inet_addr_list_test: inet_addr_list
-	$(SHLIB_ENV) ./inet_addr_list `cat inet_addr_list.in` >inet_addr_list.tmp 2>&1
+	$(SHLIB_ENV) ${VALGRIND} ./inet_addr_list `cat inet_addr_list.in` >inet_addr_list.tmp 2>&1
 	diff inet_addr_list.ref inet_addr_list.tmp
 	rm -f inet_addr_list.tmp
 
 sane_basename_test: sane_basename
-	$(SHLIB_ENV) ./sane_basename <sane_basename.in >sane_basename.tmp 2>&1
+	$(SHLIB_ENV) ${VALGRIND} ./sane_basename <sane_basename.in >sane_basename.tmp 2>&1
 	diff sane_basename.ref sane_basename.tmp
 	rm -f sane_basename.tmp
 
 base64_code_test: base64_code
-	$(SHLIB_ENV) ./base64_code
+	$(SHLIB_ENV) ${VALGRIND} ./base64_code
 
 attr_scan64_test: attr_print64 attr_scan64 attr_scan64.ref
-	($(SHLIB_ENV) ./attr_print64 2>&3 | (sleep 1;  $(SHLIB_ENV) ./attr_scan64)) >attr_scan64.tmp 2>&1 3>&1
+	($(SHLIB_ENV) ${VALGRIND} ./attr_print64 2>&3 | (sleep 1;  $(SHLIB_ENV) ./attr_scan64)) >attr_scan64.tmp 2>&1 3>&1
 	diff attr_scan64.ref attr_scan64.tmp
 	rm -f attr_scan64.tmp
 
 attr_scan0_test: attr_print0 attr_scan0 attr_scan0.ref
-	($(SHLIB_ENV) ./attr_print0 2>&3 | (sleep 1;  $(SHLIB_ENV) ./attr_scan0)) >attr_scan0.tmp 2>&1 3>&1
+	($(SHLIB_ENV) ${VALGRIND} ./attr_print0 2>&3 | (sleep 1;  $(SHLIB_ENV) ./attr_scan0)) >attr_scan0.tmp 2>&1 3>&1
 	diff attr_scan0.ref attr_scan0.tmp
 	rm -f attr_scan0.tmp
 
 dict_test: dict_open testdb dict_test.in dict_test.ref
 	rm -f testdb.db testdb.dir testdb.pag
 	$(SHLIB_ENV) ../postmap/postmap -N hash:testdb
-	$(SHLIB_ENV) ./dict_open hash:testdb write < dict_test.in 2>&1 | sed 's/uid=[0-9][0-9][0-9]*/uid=USER/' >dict_test.tmp
+	$(SHLIB_ENV) ${VALGRIND} ./dict_open hash:testdb write < dict_test.in 2>&1 | sed 's/uid=[0-9][0-9][0-9]*/uid=USER/' >dict_test.tmp
 	diff dict_test.ref dict_test.tmp
 	$(SHLIB_ENV) ../postmap/postmap -n hash:testdb
-	$(SHLIB_ENV) ./dict_open hash:testdb write < dict_test.in 2>&1 | sed 's/uid=[0-9][0-9][0-9]*/uid=USER/' >dict_test.tmp
+	$(SHLIB_ENV) ${VALGRIND} ./dict_open hash:testdb write < dict_test.in 2>&1 | sed 's/uid=[0-9][0-9][0-9]*/uid=USER/' >dict_test.tmp
 	diff dict_test.ref dict_test.tmp
 	rm -f testdb.db testdb.dir testdb.pag dict_test.tmp
 
 dict_pcre_test: dict_open dict_pcre.in dict_pcre.map dict_pcre.ref
-	$(SHLIB_ENV) ./dict_open pcre:dict_pcre.map read <dict_pcre.in 2>&1 | sed 's/uid=[0-9][0-9][0-9]*/uid=USER/' >dict_pcre.tmp
+	$(SHLIB_ENV) ${VALGRIND} ./dict_open pcre:dict_pcre.map read <dict_pcre.in 2>&1 | sed 's/uid=[0-9][0-9][0-9]*/uid=USER/' >dict_pcre.tmp
 	diff dict_pcre.ref dict_pcre.tmp
 	rm -f dict_pcre.tmp
 
 dict_regexp_test: dict_open dict_regexp.in dict_regexp.map dict_regexp.ref
-	$(SHLIB_ENV) ./dict_open regexp:dict_regexp.map read <dict_regexp.in 2>&1 | sed 's/uid=[0-9][0-9][0-9]*/uid=USER/' >dict_regexp.tmp
+	$(SHLIB_ENV) ${VALGRIND} ./dict_open regexp:dict_regexp.map read <dict_regexp.in 2>&1 | sed 's/uid=[0-9][0-9][0-9]*/uid=USER/' >dict_regexp.tmp
 	diff dict_regexp.ref dict_regexp.tmp
 	rm -f dict_regexp.tmp
 
 dict_cidr_test: dict_open dict_cidr.in dict_cidr.map dict_cidr.ref
-	$(SHLIB_ENV) ./dict_open cidr:dict_cidr.map read <dict_cidr.in 2>&1 | sed 's/uid=[0-9][0-9][0-9]*/uid=USER/' >dict_cidr.tmp
+	$(SHLIB_ENV) ${VALGRIND} ./dict_open cidr:dict_cidr.map read <dict_cidr.in 2>&1 | sed 's/uid=[0-9][0-9][0-9]*/uid=USER/' >dict_cidr.tmp
 	diff dict_cidr.ref dict_cidr.tmp
 	rm -f dict_cidr.tmp
 
 miss_endif_cidr_test: dict_open miss_endif_cidr.map miss_endif_cidr.ref
-	echo get 1.2.3.5 | $(SHLIB_ENV) ./dict_open cidr:miss_endif_cidr.map read 2>&1 | sed 's/uid=[0-9][0-9][0-9]*/uid=USER/' >dict_cidr.tmp
+	echo get 1.2.3.5 | $(SHLIB_ENV) ${VALGRIND} ./dict_open cidr:miss_endif_cidr.map read 2>&1 | sed 's/uid=[0-9][0-9][0-9]*/uid=USER/' >dict_cidr.tmp
 	diff miss_endif_cidr.ref dict_cidr.tmp
 	rm -f dict_cidr.tmp
 
 miss_endif_pcre_test: dict_open miss_endif_re.map miss_endif_pcre.ref
-	echo get 1.2.3.5 | $(SHLIB_ENV) ./dict_open pcre:miss_endif_re.map read 2>&1 | sed 's/uid=[0-9][0-9][0-9]*/uid=USER/' >dict_pcre.tmp
+	echo get 1.2.3.5 | $(SHLIB_ENV) ${VALGRIND} ./dict_open pcre:miss_endif_re.map read 2>&1 | sed 's/uid=[0-9][0-9][0-9]*/uid=USER/' >dict_pcre.tmp
 	diff miss_endif_pcre.ref dict_pcre.tmp
 	rm -f dict_pcre.tmp
 
 miss_endif_regexp_test: dict_open miss_endif_re.map miss_endif_regexp.ref
-	echo get 1.2.3.5 | $(SHLIB_ENV) ./dict_open regexp:miss_endif_re.map read 2>&1 | sed 's/uid=[0-9][0-9][0-9]*/uid=USER/' >dict_regexp.tmp
+	echo get 1.2.3.5 | $(SHLIB_ENV) ${VALGRIND} ./dict_open regexp:miss_endif_re.map read 2>&1 | sed 's/uid=[0-9][0-9][0-9]*/uid=USER/' >dict_regexp.tmp
 	diff miss_endif_regexp.ref dict_regexp.tmp
 	rm -f dict_regexp.tmp
 
 split_qnameval_test: split_qnameval update
-	$(SHLIB_ENV) ./split_qnameval
+	$(SHLIB_ENV) ${VALGRIND} ./split_qnameval
 
 dict_seq_test: dict_open testdb dict_seq.in dict_seq.ref
 	rm -f testdb.db testdb.dir testdb.pag
-	$(SHLIB_ENV) ./dict_open hash:testdb create sync < dict_seq.in 2>&1 | sed 's/uid=[0-9][0-9][0-9]*/uid=USER/' > dict_seq.tmp
+	$(SHLIB_ENV) ${VALGRIND} ./dict_open hash:testdb create sync < dict_seq.in 2>&1 | sed 's/uid=[0-9][0-9][0-9]*/uid=USER/' > dict_seq.tmp
 	diff dict_seq.ref dict_seq.tmp
 	rm -f testdb.db testdb.dir testdb.pag dict_seq.tmp
 
 host_port_test: host_port host_port.in host_port.ref
-	$(SHLIB_ENV) ./host_port <host_port.in >host_port.tmp 2>&1
+	$(SHLIB_ENV) ${VALGRIND} ./host_port <host_port.in >host_port.tmp 2>&1
 	diff host_port.ref host_port.tmp
 	rm -f host_port.tmp
 
 attr_scan_plain_test: attr_print_plain attr_scan_plain attr_scan_plain.ref
-	($(SHLIB_ENV) ./attr_print_plain 2>&3 | (sleep 1;  $(SHLIB_ENV) ./attr_scan_plain)) >attr_scan_plain.tmp 2>&1 3>&1
+	($(SHLIB_ENV) ${VALGRIND} ./attr_print_plain 2>&3 | (sleep 1;  $(SHLIB_ENV) ./attr_scan_plain)) >attr_scan_plain.tmp 2>&1 3>&1
 	diff attr_scan_plain.ref attr_scan_plain.tmp
 	rm -f attr_scan_plain.tmp
 
 htable_test: htable /usr/share/dict/words
-	$(SHLIB_ENV) ./htable < /usr/share/dict/words
+	$(SHLIB_ENV) ${VALGRIND} ./htable < /usr/share/dict/words
 
 hex_code_test: hex_code
-	$(SHLIB_ENV) ./hex_code
+	$(SHLIB_ENV) ${VALGRIND} ./hex_code
 
 timecmp_test: timecmp
-	$(SHLIB_ENV) ./timecmp
+	$(SHLIB_ENV) ${VALGRIND} ./timecmp
 
 myaddrinfo_test: myaddrinfo myaddrinfo.ref myaddrinfo.ref2
-	$(SHLIB_ENV) ./myaddrinfo all belly.porcupine.org 168.100.189.2 >myaddrinfo.tmp 2>&1
+	$(SHLIB_ENV) ${VALGRIND} ./myaddrinfo all belly.porcupine.org 168.100.189.2 >myaddrinfo.tmp 2>&1
 	diff myaddrinfo.ref myaddrinfo.tmp
 	rm -f myaddrinfo.tmp
-	$(SHLIB_ENV) ./myaddrinfo all null.porcupine.org 10.0.0.0 >myaddrinfo.tmp 2>&1
+	$(SHLIB_ENV) ${VALGRIND} ./myaddrinfo all null.porcupine.org 10.0.0.0 >myaddrinfo.tmp 2>&1
 	diff myaddrinfo.ref2 myaddrinfo.tmp
 	rm -f myaddrinfo.tmp
 
 myaddrinfo4_test: myaddrinfo4 myaddrinfo4.ref myaddrinfo4.ref2
-	$(SHLIB_ENV) ./myaddrinfo4 all belly.porcupine.org 168.100.189.2 >myaddrinfo4.tmp 2>&1
+	$(SHLIB_ENV) ${VALGRIND} ./myaddrinfo4 all belly.porcupine.org 168.100.189.2 >myaddrinfo4.tmp 2>&1
 	diff myaddrinfo4.ref myaddrinfo4.tmp
-	$(SHLIB_ENV) ./myaddrinfo4 all null.porcupine.org 10.0.0.0 >myaddrinfo4.tmp 2>&1
+	$(SHLIB_ENV) ${VALGRIND} ./myaddrinfo4 all null.porcupine.org 10.0.0.0 >myaddrinfo4.tmp 2>&1
 	diff myaddrinfo4.ref2 myaddrinfo4.tmp
 	rm -f myaddrinfo4.tmp
 
 format_tv_test: format_tv format_tv.in format_tv.ref
-	$(SHLIB_ENV) ./format_tv <format_tv.in >format_tv.tmp
+	$(SHLIB_ENV) ${VALGRIND} ./format_tv <format_tv.in >format_tv.tmp
 	diff format_tv.ref format_tv.tmp
 	rm -f format_tv.tmp
 
 ip_match_test: ip_match ip_match.in ip_match.ref
-	$(SHLIB_ENV) ./ip_match <ip_match.in >ip_match.tmp
+	$(SHLIB_ENV) ${VALGRIND} ./ip_match <ip_match.in >ip_match.tmp
 	diff ip_match.ref ip_match.tmp
 	rm -f ip_match.tmp
 
@@ -696,57 +696,57 @@ name_mask_tests: name_mask_test0 name_mask_test1 name_mask_test2 \
 	name_mask_test7 name_mask_test8 name_mask_test9
 
 name_mask_test0: name_mask name_mask.in name_mask.ref0
-	$(SHLIB_ENV) ./name_mask IGNORE IGNORE < name_mask.in > name_mask.tmp 2>&0
+	$(SHLIB_ENV) ${VALGRIND} ./name_mask IGNORE IGNORE < name_mask.in > name_mask.tmp 2>&0
 	diff name_mask.ref0 name_mask.tmp
 	rm -f name_mask.tmp
 
 name_mask_test1: name_mask name_mask.in name_mask.ref1
-	$(SHLIB_ENV) ./name_mask NUMBER,WARN NUMBER < name_mask.in > name_mask.tmp 2>&1
+	$(SHLIB_ENV) ${VALGRIND} ./name_mask NUMBER,WARN NUMBER < name_mask.in > name_mask.tmp 2>&1
 	diff name_mask.ref1 name_mask.tmp
 	rm -f name_mask.tmp
 
 name_mask_test2: name_mask name_mask.in name_mask.ref2
-	$(SHLIB_ENV) ./name_mask NUMBER,RETURN NUMBER < name_mask.in > name_mask.tmp 2>&1
+	$(SHLIB_ENV) ${VALGRIND} ./name_mask NUMBER,RETURN NUMBER < name_mask.in > name_mask.tmp 2>&1
 	diff name_mask.ref2 name_mask.tmp
 	rm -f name_mask.tmp
 
 name_mask_test3: name_mask name_mask.in name_mask.ref3
-	$(SHLIB_ENV) ./name_mask WARN NUMBER < name_mask.in > name_mask.tmp 2>&1
+	$(SHLIB_ENV) ${VALGRIND} ./name_mask WARN NUMBER < name_mask.in > name_mask.tmp 2>&1
 	diff name_mask.ref3 name_mask.tmp
 	rm -f name_mask.tmp
 
 name_mask_test4: name_mask name_mask.in name_mask.ref4
-	$(SHLIB_ENV) ./name_mask RETURN NUMBER < name_mask.in > name_mask.tmp 2>&1
+	$(SHLIB_ENV) ${VALGRIND} ./name_mask RETURN NUMBER < name_mask.in > name_mask.tmp 2>&1
 	diff name_mask.ref4 name_mask.tmp
 	rm -f name_mask.tmp
 
 name_mask_test5: name_mask name_mask.in name_mask.ref5
-	$(SHLIB_ENV) ./name_mask NUMBER,WARN RETURN < name_mask.in > name_mask.tmp 2>&1
+	$(SHLIB_ENV) ${VALGRIND} ./name_mask NUMBER,WARN RETURN < name_mask.in > name_mask.tmp 2>&1
 	diff name_mask.ref5 name_mask.tmp
 	rm -f name_mask.tmp
 
 name_mask_test6: name_mask name_mask.in name_mask.ref6
-	$(SHLIB_ENV) ./name_mask NUMBER,WARN WARN < name_mask.in > name_mask.tmp 2>&1
+	$(SHLIB_ENV) ${VALGRIND} ./name_mask NUMBER,WARN WARN < name_mask.in > name_mask.tmp 2>&1
 	diff name_mask.ref6 name_mask.tmp
 	rm -f name_mask.tmp
 
 name_mask_test7: name_mask name_mask.in name_mask.ref7
-	$(SHLIB_ENV) ./name_mask NUMBER,WARN IGNORE < name_mask.in > name_mask.tmp 2>&1
+	$(SHLIB_ENV) ${VALGRIND} ./name_mask NUMBER,WARN IGNORE < name_mask.in > name_mask.tmp 2>&1
 	diff name_mask.ref7 name_mask.tmp
 	rm -f name_mask.tmp
 
 name_mask_test8: name_mask name_mask.in name_mask.ref8
-	$(SHLIB_ENV) ./name_mask NUMBER,WARN NUMBER,COMMA < name_mask.in > name_mask.tmp 2>&1
+	$(SHLIB_ENV) ${VALGRIND} ./name_mask NUMBER,WARN NUMBER,COMMA < name_mask.in > name_mask.tmp 2>&1
 	diff name_mask.ref8 name_mask.tmp
 	rm -f name_mask.tmp
 
 name_mask_test9: name_mask name_mask.in name_mask.ref9
-	$(SHLIB_ENV) ./name_mask NUMBER,WARN NUMBER,PIPE < name_mask.in > name_mask.tmp 2>&1
+	$(SHLIB_ENV) ${VALGRIND} ./name_mask NUMBER,WARN NUMBER,PIPE < name_mask.in > name_mask.tmp 2>&1
 	diff name_mask.ref9 name_mask.tmp
 	rm -f name_mask.tmp
 
 base32_code_test: base32_code
-	$(SHLIB_ENV) ./base32_code
+	$(SHLIB_ENV) ${VALGRIND} ./base32_code
 
 dict_thash_test: ../postmap/postmap dict_thash.map dict_thash.in dict_thash.ref
 	$(SHLIB_ENV) ../postmap/postmap -fs texthash:dict_thash.map 2>&1 | \
@@ -757,54 +757,54 @@ dict_thash_test: ../postmap/postmap dict_thash.map dict_thash.in dict_thash.ref
 
 surrogate_test: dict_open surrogate.ref
 	cp /dev/null surrogate.tmp
-	echo get foo|$(SHLIB_ENV) ./dict_open cidr:/xx write >>surrogate.tmp 2>&1
+	echo get foo|$(SHLIB_ENV) ${VALGRIND} ./dict_open cidr:/xx write >>surrogate.tmp 2>&1
-	echo get foo|$(SHLIB_ENV) ./dict_open cidr:/xx read >>surrogate.tmp 2>&1
+	echo get foo|$(SHLIB_ENV) ${VALGRIND} ./dict_open cidr:/xx read >>surrogate.tmp 2>&1
-	echo get foo|$(SHLIB_ENV) ./dict_open pcre:/xx write >>surrogate.tmp 2>&1
+	echo get foo|$(SHLIB_ENV) ${VALGRIND} ./dict_open pcre:/xx write >>surrogate.tmp 2>&1
-	echo get foo|$(SHLIB_ENV) ./dict_open pcre:/xx read >>surrogate.tmp 2>&1
+	echo get foo|$(SHLIB_ENV) ${VALGRIND} ./dict_open pcre:/xx read >>surrogate.tmp 2>&1
-	echo get foo|$(SHLIB_ENV) ./dict_open regexp:/xx write >>surrogate.tmp 2>&1
+	echo get foo|$(SHLIB_ENV) ${VALGRIND} ./dict_open regexp:/xx write >>surrogate.tmp 2>&1
-	echo get foo|$(SHLIB_ENV) ./dict_open regexp:/xx read >>surrogate.tmp 2>&1
+	echo get foo|$(SHLIB_ENV) ${VALGRIND} ./dict_open regexp:/xx read >>surrogate.tmp 2>&1
-	echo get foo|$(SHLIB_ENV) ./dict_open unix:xx write >>surrogate.tmp 2>&1
+	echo get foo|$(SHLIB_ENV) ${VALGRIND} ./dict_open unix:xx write >>surrogate.tmp 2>&1
-	echo get foo|$(SHLIB_ENV) ./dict_open unix:xx read >>surrogate.tmp 2>&1
+	echo get foo|$(SHLIB_ENV) ${VALGRIND} ./dict_open unix:xx read >>surrogate.tmp 2>&1
-	echo get foo|$(SHLIB_ENV) ./dict_open texthash:/xx write >>surrogate.tmp 2>&1
+	echo get foo|$(SHLIB_ENV) ${VALGRIND} ./dict_open texthash:/xx write >>surrogate.tmp 2>&1
-	echo get foo|$(SHLIB_ENV) ./dict_open texthash:/xx read >>surrogate.tmp 2>&1
+	echo get foo|$(SHLIB_ENV) ${VALGRIND} ./dict_open texthash:/xx read >>surrogate.tmp 2>&1
-	echo get foo|$(SHLIB_ENV) ./dict_open hash:/xx read >>surrogate.tmp 2>&1
+	echo get foo|$(SHLIB_ENV) ${VALGRIND} ./dict_open hash:/xx read >>surrogate.tmp 2>&1
 	diff surrogate.ref surrogate.tmp
 	rm -f surrogate.tmp
 
 dict_static_test: dict_open dict_static.ref
 	(set -e; \
 	(echo get foo; echo get bar) | $(SHLIB_ENV) \
-	    ./dict_open static:fooxx read; \
+	    ${VALGRIND} ./dict_open static:fooxx read; \
-	$(SHLIB_ENV) ./dict_open static:'{ foo xx ' read </dev/null; \
+	$(SHLIB_ENV) ${VALGRIND} ./dict_open static:'{ foo xx ' read </dev/null; \
-	$(SHLIB_ENV) ./dict_open static:'{ foo xx }x' read </dev/null; \
+	$(SHLIB_ENV) ${VALGRIND} ./dict_open static:'{ foo xx }x' read </dev/null; \
 	(echo get foo; echo get bar) | $(SHLIB_ENV) \
-	    ./dict_open static:'{ foo xx }' read; \
+	    ${VALGRIND} ./dict_open static:'{ foo xx }' read; \
 	) >dict_static.tmp 2>&1
 	diff dict_static.ref dict_static.tmp
 	rm -f dict_static.tmp
 
 dict_inline_test: dict_open dict_inline.ref
 	(set -e; \
-	$(SHLIB_ENV) ./dict_open inline:'{ }' read </dev/null; \
+	$(SHLIB_ENV) ${VALGRIND} ./dict_open inline:'{ }' read </dev/null; \
-	$(SHLIB_ENV) ./dict_open inline:'{ foo = xx }' read </dev/null; \
+	$(SHLIB_ENV) ${VALGRIND} ./dict_open inline:'{ foo = xx }' read </dev/null; \
-	$(SHLIB_ENV) ./dict_open inline:'{ foo=xx }x' read </dev/null; \
+	$(SHLIB_ENV) ${VALGRIND} ./dict_open inline:'{ foo=xx }x' read </dev/null; \
-	$(SHLIB_ENV) ./dict_open inline:'{ foo=xx x' read </dev/null; \
+	$(SHLIB_ENV) ${VALGRIND} ./dict_open inline:'{ foo=xx x' read </dev/null; \
-	$(SHLIB_ENV) ./dict_open inline:'{ foo=xx {x=y}x}' read </dev/null; \
+	$(SHLIB_ENV) ${VALGRIND} ./dict_open inline:'{ foo=xx {x=y}x}' read </dev/null; \
 	(echo get foo; echo get bar; echo get baz) | $(SHLIB_ENV) \
-	    ./dict_open inline:'{ foo=XX, { bAr = lotsa stuff }}' read fold_fix; \
+	    ${VALGRIND} ./dict_open inline:'{ foo=XX, { bAr = lotsa stuff }}' read fold_fix; \
 	(echo get foo; echo get bar; echo get baz) | $(SHLIB_ENV) \
-	    ./dict_open inline:'{ foo=XX, { bAr = lotsa stuff }}' read 'fold_fix,utf8_request'; \
+	    ${VALGRIND} ./dict_open inline:'{ foo=XX, { bAr = lotsa stuff }}' read 'fold_fix,utf8_request'; \
 	) >dict_inline.tmp 2>&1
 	diff dict_inline.ref dict_inline.tmp
 	rm -f dict_inline.tmp
 
 midna_domain_test: midna_domain midna_domain_test.in midna_domain_test.ref
-	$(SHLIB_ENV) ./midna_domain <midna_domain_test.in >midna_domain_test.tmp 2>&1
+	$(SHLIB_ENV) ${VALGRIND} ./midna_domain <midna_domain_test.in >midna_domain_test.tmp 2>&1
 	diff midna_domain_test.ref midna_domain_test.tmp
 	rm -f midna_domain_test.tmp
 
 casefold_test: casefold casefold_test.in casefold_test.ref
-	$(SHLIB_ENV) ./casefold <casefold_test.in >casefold_test.tmp 2>&1
+	$(SHLIB_ENV) ${VALGRIND} ./casefold <casefold_test.in >casefold_test.tmp 2>&1
 	diff casefold_test.ref casefold_test.tmp
 	rm -f casefold_test.tmp
 
@@ -815,12 +815,12 @@ dict_utf8_test: dict_open dict_utf8_test.in dict_utf8_test.ref
 
 strcasecmp_utf8_test: strcasecmp_utf8 strcasecmp_utf8_test.in \
 	strcasecmp_utf8_test.ref
-	$(SHLIB_ENV) ./strcasecmp_utf8 <strcasecmp_utf8_test.in >strcasecmp_utf8_test.tmp 2>&1
+	$(SHLIB_ENV) ${VALGRIND} ./strcasecmp_utf8 <strcasecmp_utf8_test.in >strcasecmp_utf8_test.tmp 2>&1
 	diff strcasecmp_utf8_test.ref strcasecmp_utf8_test.tmp
 	rm -f strcasecmp_utf8_test.tmp
 
 vbuf_print_test: vbuf_print vbuf_print_test.in vbuf_print_test.ref
-	$(SHLIB_ENV) ./vbuf_print <vbuf_print_test.in >vbuf_print_test.tmp 2>&1
+	$(SHLIB_ENV) ${VALGRIND} ./vbuf_print <vbuf_print_test.in >vbuf_print_test.tmp 2>&1
 	diff vbuf_print_test.ref vbuf_print_test.tmp
 	rm -f vbuf_print_test.tmp
 
@@ -1779,8 +1779,6 @@ load_file.o: vbuf.h
 load_file.o: vstream.h
 load_file.o: warn_stat.h
 load_lib.o: load_lib.c
-load_lib.o: load_lib.h
-load_lib.o: msg.h
 load_lib.o: sys_defs.h
 lowercase.o: check_arg.h
 lowercase.o: lowercase.c

postfix/src/util/clean_env.c

@@ -8,12 +8,18 @@
 /*
 /*	void	clean_env(preserve_list)
 /*	const char **preserve_list;
+/*
+/*	void	update_env(preserve_list)
+/*	const char **preserve_list;
 /* DESCRIPTION
 /*	clean_env() reduces the process environment to the bare minimum.
 /*	The function takes a null-terminated list of arguments.
 /*	Each argument specifies the name of an environment variable
 /*	that should be preserved, or specifies a name=value that should
 /*	be entered into the new environment.
+/*
+/*	update_env() applies name=value settings, but otherwise does not
+/*	change the process environment.
 /* DIAGNOSTICS
 /*	Fatal error: out of memory.
 /* SEE ALSO
@@ -85,3 +91,33 @@ void    clean_env(char **preserve_list)
      */
     argv_free(save_list);
 }
+
+/* update_env - apply name=value settings only */
+
+void    update_env(char **preserve_list)
+{
+    char  **cpp;
+    ARGV   *save_list;
+    char   *eq;
+
+    /*
+     * Extract name=value settings.
+     */
+    save_list = argv_alloc(10);
+    for (cpp = preserve_list; *cpp; cpp++)
+	if ((eq = strchr(*cpp, '=')) != 0)
+	    argv_addn(save_list, STRING_AND_LENGTH(*cpp, eq - *cpp),
+		      STRING_AND_LENGTH(eq + 1, strlen(eq + 1)), (char *) 0);
+
+    /*
+     * Apply name=value settings.
+     */
+    for (cpp = save_list->argv; *cpp; cpp += 2)
+	if (setenv(cpp[0], cpp[1], 1))
+	    msg_fatal("setenv(%s, %s): %m", cpp[0], cpp[1]);
+
+    /*
+     * Cleanup.
+     */
+    argv_free(save_list);
+}

postfix/src/util/clean_env.h

@@ -15,6 +15,7 @@
   * External interface.
   */
 extern void clean_env(char **);
+extern void update_env(char **);
 
 /* LICENSE
 /* .ad

postfix/src/util/dict_pipe_test.in

@@ -1,9 +1,9 @@
-./dict_open 'pipemap:{inline:{k1=v1,k2=v2},inline:{v2=v3}}' read <<EOF
+${VALGRIND} ./dict_open 'pipemap:{inline:{k1=v1,k2=v2},inline:{v2=v3}}' read <<EOF
 get k0
 get k1
 get k2
 EOF
-./dict_open 'pipemap:{inline:{k1=v1},fail:fail}' read <<EOF
+${VALGRIND} ./dict_open 'pipemap:{inline:{k1=v1},fail:fail}' read <<EOF
 get k0
 get k1
 EOF

postfix/src/util/dict_union_test.in

@@ -1,7 +1,7 @@
-./dict_open 'unionmap:{static:one,static:two,inline:{foo=three}}' read <<EOF
+${VALGRIND} ./dict_open 'unionmap:{static:one,static:two,inline:{foo=three}}' read <<EOF
 get foo
 get bar
 EOF
-./dict_open 'unionmap:{static:one,fail:fail}' read <<EOF
+${VALGRIND} ./dict_open 'unionmap:{static:one,fail:fail}' read <<EOF
 get foo
 EOF

postfix/src/util/dict_utf8_test.in

@@ -11,4 +11,4 @@ LC_ALL=C awk 'BEGIN {
 	printf "put xxx %c%c%c\n", 128, 128, 128
 	printf "get xxx\n"
 	exit
-}' | ./dict_open internal:whatever write utf8_request
+}' | ${VALGRIND} ./dict_open internal:whatever write utf8_request

postfix/src/util/sys_compat.c

@@ -17,6 +17,9 @@
 /*	const char *value;
 /*	int	clobber;
 /*
+/*	int	unsetenv(name)
+/*	const char *name;
+/*
 /*	int	seteuid(euid)
 /*	uid_t	euid;
 /*
@@ -116,6 +119,27 @@ int     setenv(const char *name, const char *value, int clobber)
     return (putenv(cp));
 }
 
+/* unsetenv - remove all instances of the name */
+
+int     unsetenv(const char *name)
+{
+    extern char **environ;
+    ssize_t name_len = strlen(name);
+    char  **src_pp;
+    char  **dst_pp;
+
+    for (dst_pp = src_pp = environ; *src_pp; src_pp++, dst_pp++) {
+	if (strncmp(*src_pp, name, name_len) == 0
+	    && *(*src_pp + name_len) == '=') {
+	    dst_pp--;
+	} else if (dst_pp != src_pp) {
+	    *dst_pp = *src_pp;
+	}
+    }
+    *dst_pp = 0;
+    return (0);
+}
+
 #endif
 
  /*

postfix/src/util/sys_defs.h

@@ -417,7 +417,6 @@ extern int opterr;
 #define SUPPORTED
 #define UINT32_TYPE	unsigned int
 #define UINT16_TYPE	unsigned short
-#define MISSING_SETENV
 #define _PATH_MAILDIR	"/var/mail"
 #define _PATH_BSHELL	"/bin/sh"
 #define _PATH_DEFPATH	"/usr/bin:/usr/ucb"